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INTERNET SECURITY 


WEDNESDAY, MARCH 8, 2000 

U.S. Senate, 

Subcommittee on Communications, 
Committee on Commerce, Science, and Transportation, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 9:35 a.m. in room 
SR-253, Russell Senate Office Building, Hon. Conrad Burns, Chair- 
man of the Subcommittee, presiding. 

OPENING STATEMENT OF HON. CONRAD BURNS, 

U.S. SENATOR FROM MONTANA 

Senator Burns. The Subcommittee on Communications of the 
Commerce, Science, and Transportation Committee will come to 
order. First, I would like to welcome everyone to today’s hearing, 
which is the first of a series of hearings that this Subcommittee 
will hold on the critical issues of Internet security and privacy fac- 
ing our Nation. 

Today’s hearing will focus on the unprecedented and apparently 
coordinated recent series of hacker attacks which caused some of 
the most popular Web sites on the Internet to go dark. The list of 
sites that were brought down include such Internet mainstays as 
Amazon.com, eBay, my Auction Barn was shut down, no telling 
how much money it cost me 

[Laughter.] 

Senator Burns. — cnn.com and e-Trade and Yahoo. 

These attacks are technically called “distributed denial of service 
attacks,” which in plain English is like a telephone system getting 
overwhelmed by more calls than it can handle. It appears the hack- 
ers planned their attacks months in advance, going so far as to set 
up software on many servers all over the Internet that was capable 
of automatically flooding targeted Web sites at a certain predeter- 
mined time. 

I suppose it is no surprise that these malicious programs are 
called “daemons,” spelled d-a-e-m-o-n-s. The hackers involved in 
these attacks have yet to be caught, despite the coordinated efforts 
of our Nation’s top law enforcement agencies. 

While no consumer data was stolen, real damage was done, espe- 
cially to Internet user’s confidence about the security systems that 
they are using. The fear of future attacks was enough to cause a 
massive sell-off in technology stocks in early February, when the 
attacks took place, and the nature of these attacks is particularly 
alarming, as they were specifically designed to disrupt electronic 
commerce. 


( 1 ) 



2 


The growth of electronic commerce and the Internet has been 
generally astounding. The number of small businesses on the Web 
is doubling every year, and currently over 2 million small busi- 
nesses in the United States have Web sites. In my home State of 
Montana, companies such as Vanns.com and Streaming Solutions 
are showing that all their great work and great ideas are coming 
to fruition. E-commerce potential of the Internet still has tremen- 
dous up-side, while household spending online last year doubled. It 
is still only about 1 percent of the total retail dollars. 

The growth in the Internet is a double-edged sword, however. 
Unfortunately we now live in a world where there are malicious 
criminals who can bring large parts of our Nation’s critical infor- 
mation infrastructure to a grinding halt. Given the seriousness of 
these attacks, we must act not only quickly but effectively. We 
must think it out and work in the best way. In other words, we 
cannot out-force our enemies. We must out-think them and be 
smarter than they are. 

We need to do everything possible to foster better coordination 
between Government and industry in protecting Internet security, 
make sure that our national security and our law enforcement 
agencies have the resources to do their job, and to bring our Na- 
tion’s criminal code up to date with the recent development of the 
Internet. Clearly, the current level of coordination between Govern- 
ment agencies and the private sector needs to be as seamless and 
effective as possible. 

A core component of achieving this cooperation is the continuing 
development of the FBI’s National Infrastructure Protection Cen- 
ter, which was set up 2 years ago to deal with the range of poten- 
tial attacks on the Internet. I strongly supported the creation of 
that center, and I will continue to support its full funding. In fact, 
I want to make it even stronger. 

I am concerned, however, that the center is authorized for 133 
employees. We are only up to about 100 now, 40 of whom are 
detailees from other agencies, but I also understand the FBI is still 
short of its goal of hiring 250 field agents to fight cybercrime. 
While I realize that hiring top-level technical experts to work in 
Government is difficult, given the lure of Silicon Valley, these posi- 
tions need to be filled as quickly as possible, and that is what I 
have always argued in the past, and I want to make a comment 
on that this morning. 

Instead of putting a lid on technology we need to fully fund and 
fully support our law enforcement agencies so they are abreast of 
or half a step ahead and working with industry in the technology 
so they can get their job done, so we need a lot of work, and I am 
going to put the rest of my statement in here, because I do want 
to hear from witnesses this morning. 

[The prepared statement of Senator Burns follows:] 

Prepared Statement of Hon. Conrad Burns, U.S. Senator from Montana 

I would like to welcome everyone to today’s hearing, which is the first in a series 
of hearings this Subcommittee will be holding on the critical issues of Internet secu- 
rity and privacy facing our nation. Today’s hearing will focus on the unprecedented 
and apparently coordinated recent series of hacker attacks which caused some of the 
most popular websites on the Internet to go dark. The list of sites that were brought 
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down included such Internet mainstays as Amazon.com, eBay, cnn.com, e-Trade and 
Yahoo. 

These attacks are technically called “distributed denial of service attacks” which 
in plain English is like a telephone system getting overwhelmed by more calls than 
it can handle. It appears the hackers planned their attacks months in advance, 
going so far as to set up software on many servers all over the Internet that was 
capable of automatically flooding targeted websites at certain predetermined times. 
I suppose it’s no surprise that these malicious programs are called “daemons.” The 
hackers involved in theses attacks have yet to be caught, despite the coordinated 
efforts of our nation’s top law enforcement agencies. 

While no consumer data was stolen, real damage was done-especially to Internet 
users’ confidence about the security of the systems they are using. The fear of future 
attacks was great enough to cause a massive selloff in technology stocks in early 
February when the attacks took place. The nature of these attacks is particularly 
alarming, as they were specifically designed to disrupt electronic commerce. 

The growth of electronic commerce and the Internet in general has been astound- 
ing. The number of small businesses on the Web is doubling every year, and cur- 
rently over 2 million small businesses in the United States have websites. In my 
home state of Montana, companies such as Vanns.com and Streaming Solutions are 
showing that all it takes is a great idea and hard work to reach global markets 
through the Internet. The e-commerce potential of the Internet still has tremendous 
upside — while household spending online doubled last year, it still amounted to less 
than 1 percent of total retail dollars. 

The growth and reach of the Internet is a double-edged sword, however. Unfortu- 
nately, we now live in a world where malicious criminals can bring large parts of 
the nation’s critical information infrastructure to a grinding halt. 

Given the seriousness of these attacks, we must act quickly and effectively. We 
need to do everything possible to foster better coordination between Government 
and industry in protecting Internet security, make sure our national security and 
law enforcement agencies have the resources to do their jobs and bring our nation’s 
criminal code up-to-date with the recent development of the Internet. 

Clearly, the current level of coordination between Government agencies and the 
private sector needs to be as seamless and effective as possibe. A core component 
in achieving this cooperation is the continuing development of the FBI’s National 
Infrastructure Protection Center, which was setup two years ago to deal with a 
range of potential attacks on the Internet. I strongly supported the creation of the 
Center and continue to support its full funding. 

However, I am concerned that while the Center is authorized for 133 employees, 
its staff is still at only 100, 40 of whom are detailees from other agencies. I also 
understand the FBI is still short of its goal of hiring 250 field agents to fight 
cybercrime. While I realize that hiring top-level technical experts to work in the 
Government is difficult given the lure of Silicon Valley, these positions need to be 
filled as quickly as possible. 

I want to touch on the issue of criminal penalties on hackers. In the recent past, 
many if not most “hacker” attacks were the product of intellectual curiosity rather 
than malicious intent to cause damage. Now, however, the vast majority of hacker 
attacks are done through simply downloading pre-existing programs from hacker 
sites on the web and using them to accomplish destructive aims. Rather than stem- 
ming from misdirected teenage rebellion, current attacks are often engaged in by 
adults who want to inflict the most damage possible. We need to severely punish 
these criminals-and they are criminals. The destruction of data belonging to inno- 
cent individuals is no less a crime than property destruction of the more traditional 
type. In fact, it can in many cases be far worse. 

We are fortunate to have some of the foremost Government and industry experts 
in the field of Internet security with us today. I look forward to the testimony of 
the witnesses in addressing these matters of critical importance to the continued de- 
velopment of e-commerce and the Internet. Thank you. 

Senator Burns. We are joined this morning by Senator Hollings. 
Thank you for coming. 

STATEMENT OF HON. ERNEST F. HOLLINGS, 

U.S. SENATOR FROM SOUTH CAROLINA 

Senator Hollings. Thank you, Mr. Chairman. If I heard you cor- 
rectly, you said we are going to have to be smarter than they are. 
If we wait on Government to be smarter, that is quite a charge. 
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Senator Burns. We are not asking for the impossible. 

Senator Hollings. That is near it. We are back — history repeats 
itself. You have got to think of David Sarnoff on the Wannamaker 
Building and the sinking of the LUSITANIA. He picked it up. The 
country went wild over wireless, and by the mid-twenties every- 
body was jamming. Everybody in the so-called free market of com- 
munications came crying to Government, please regulate us. Now 
history repeats itself. They come crying to Government, please give 
us security, please give us privacy, because they cannot do it them- 
selves. They say it takes two to tango. You cannot have privacy 
without security. 

So the Justice Department has been working diligently and I 
might add, Mr. Chairman, the Justice Department has grown quite 
a bit in recent years. Slightly over 10 years ago the budget in the 
Justice Department was $4 billion. It is now $23 billion. Everybody 
says cut spending, cut spending, cut spending, but the Senators 
ought to know we have been increasing it like gangbusters, and 
giving the Justice Department everything they say they can pos- 
sibly use, and they have been doing an outstanding job. 

In essence, the National Institute of Standards and Technology 
is really onto the technology, and I am delighted to hear from the 
witnesses, and I would ask the remainder of my statement be in- 
cluded. 

[The prepared statement of Senator Hollings follows:] 

Prepared Statement of Hon. Ernest F. Hollings, 

U.S. Senator from South Carolina 

Senator Burns, thank you for holding this hearing today. It is the first hearing 
in a series that the Committee intends to hold on the subject of electronic privacy. 

Internet security and hacking are not generally discussed in the context of pri- 
vacy, but I think that this is an important first topic for consideration. No matter 
what we decide on the right policy to protect consumers on the Internet is, no policy 
can work without a secure infrastructure. A company can have the strongest privacy 
policy in the world, but that policy is irrelevant if the company has not adequately 
protected its systems from illegitimate users. 

A month ago at this time, Mr. Misener’s company, among others, was under at- 
tack. That attack highlighted problems which have plagued the users of the Internet 
for some time. Having been brought under the media spotlight the question now is: 
How can we be sure that the companies we are doing business with on the Internet 
are secure? Additionally, what do businesses owe their consumers when they are 
victims of computer break in? 

In order to make consumer information safe from hackers, it will be necessary to 
raise the security standards of Internet-based businesses as a whole. As we try to 
craft public policy in this area, we need to examine three constructive roles for Gov- 
ernment: (1) fostering constructive partnerships which enhance private sector secu- 
rity; (2) pushing the technological envelope on information infrastructure protection; 
and (3) being a role model through the implementation of best security practices. 

In other words, the Government must be prepared to form a partnership with in- 
dustry to share information on new attacks and how to stop them. Our research 
agencies must invest in solving problems which will bolster the security of the whole 
Internet rather than its parts. Finally, the Government needs to do a better job of 
protecting its own information. Right now, our departments and agencies are far 
from a shining example of what Internet security can be. We need to have in place 
the right policies, hardware, software, and trained personnel to secure Government 
computer systems. I hope that our witnesses will address these areas in their testi- 
mony today. 

Already, various agencies of the U.S. Department of Commerce are doing impor- 
tant computer security work. Undersecretary Reinsch oversees the Critical Infra- 
structure Assurance Office (CIAO) which is coordinating partnerships with the pri- 
vate sector to examine attack prevention. The National Institute of Standards and 
Technology (NIST) is a leader in computer security research and, through the 1987 
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Computer Security Act, sets standards for securing unclassified Government com- 
puter systems. The FY 2001 budget request for information security would enhance 
these capabilities at Department of Commerce and in other agencies of Government. 

Again, I look forward to hearing the testimony of today’s witnesses on how we 
can improve Internet security in this nation and what the role of the Government 
should be in achieving that goal. 

Senator Burns. Thank you, Senator Hollings. Senator Bryan. 

STATEMENT OF HON. RICHARD H. BRYAN, 

U.S. SENATOR FROM NEVADA 

Senator Bryan. Mr. Chairman, thank you very much for con- 
vening this important and timely hearing this morning. As Vice 
Chairman of the Intelligence Committee, we are very much aware 
of the importance, in terms of our national security concerns, of 
computer hacking. All of us have been mindful of the recent suc- 
cessful attacks against some of the most significant Web sites in 
the country, and so I will be looking forward to hearing the testi- 
mony of our distinguished witnesses this morning. I would ask 
unanimous consent that the rest of my statement be made a part 
of the record. 

Senator Burns. Without objection, it sure will. 

[The prepared statement of Senator Bryan follows:] 

Prepared Statement of Hon. Richard H. Bryan, 

U.S. Senator from Neveda 

As our society continues to become more reliant on the Internet to conduct our 
daily affairs, the issue of Internet security becomes increasingly important for both 
the public and private sector. As Vice Chairman of the Intelligence Committee, I am 
very familiar with the national security concerns confronting our intelligence com- 
munity on a daily basis that result from computer hacking. And as public agencies 
at all levels of Government continue to do more and more of their business online, 
Internet security becomes a paramount issue for Government officials. I look for- 
ward to hearing from our Government witnesses today, especially Deputy Attorney 
General Holder, on what additional law enforcement tools and other measures are 
needed to protect the integrity of the Federal Government’s computer systems. 

The recent denial of service attacks against a handful of the top U.S. web sites 
was a good illustration of the vulnerabilities faced by the private sector. Perhaps 
even more alarming, however, are the privacy concerns associated with security 
breaches for companies that gather large amounts of personally identifiable informa- 
tion about consumers over the Internet. The issues related to online privacy and 
Internet security are clearly interrelated, and I look forward to hearing our wit- 
nesses comment on what role the Federal Government should play in these areas. 

Senator Burns. Our first panel this morning is Mr. Eric Holder, 
Deputy Attorney General, U.S. Department of Justice, Mr. William 
Reinsch, Under Secretary of Commerce for Bureau of Export Ad- 
ministration, Department of Commerce, and Michael Vatis, Deputy 
Assistant Director, Federal Bureau of Investigation here in Wash- 
ington, D.C. 

Gentlemen, we welcome you to the table this morning. We look 
forward to your testimony, and the dialog that we may present this 
morning on this subject, and I will just start as they are listed. 
Mr. Holder, thank you for coming this morning. We look forward 
to your testimony. 

STATEMENT OF ERIC HOLDER, JR., DEPUTY ATTORNEY 
GENERAL, U.S. DEPARTMENT OF JUSTICE 

Mr. Holder. Thank you, Mr. Chairman, Senator Hollings, Sen- 
ator Bryan, other members of the Subcommittee. I want to thank 
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you for the opportunity to testify on cybercrime, including the re- 
cent Internet denial of service attacks. The Department appreciates 
the support we have received from Congress in providing signifi- 
cant resources and tools we need to keep pace with the ever-chang- 
ing kind of cybercrime. We look forward to continuing our coopera- 
tion with Congress to ensure that law enforcement, in cooperation 
with the private sector — and that is very key, in cooperation with 
the private sector, play an appropriate role in protecting American 
citizens and businesses against cyber attacks while also safe- 
guarding the privacy rights we hold dear in our country. 

I would be happy to address your questions on the recent attacks 
to the extent that I can without compromising our investigation. At 
this point, I would simply say we are taking the attacks very seri- 
ously, and that we will do everything in our power to identify those 
who are responsible and to bring them to justice. 

We are making, I think, progress in the investigation, and in ad- 
dition to the malicious disruption of the legitimate commerce, so- 
called disruption attacks, they also involve the unlawful intrusion 
into a number of computers. Thus, the number of victims in these 
types of cases can be substantial, and the loss and cost to respond 
to those attacks can run into the tens of millions of dollars or more. 

Computer crime investigators in a number of FBI field offices 
and investigators from other agencies are investigating these at- 
tacks. The agents are also working closely with our network of spe- 
cially trained computer crime prosecutors who are available 24 
hours a day, 7 days a week to provide legal advice and to obtain 
whatever court orders are necessary. We are also obtaining infor- 
mation from victim companies and security experts who, like many 
in the Internet community, condemn these recent attacks. 

Now, while the Internet is providing wonderful benefits that are 
transforming our society and countless beneficial ways, from pro- 
viding new high-wage jobs to our economy, to improving health 
care, and in countless other ways, these wonderful technologies 
also provide new opportunities for criminals. 

Online crime is rapidly increasing. We are seeing more pure com- 
puter crime, that is, crimes where the computer is used as a weap- 
on to attack other computers, as we saw in the distributed denial 
of service attacks I just spoke about, and in the spread of malicious 
codes like viruses. These crimes not only affect our financial well- 
being and our privacy, they also threaten our Nation’s critical in- 
frastructure. 

We are also seeing a migration of traditional crimes, including 
threats, child pornography, fraud, gambling, and extortion from the 
physical to the online world. When these crimes are carried out on- 
line, perpetrators often find that they can reach more victims 
quickly and quite easily, turning what were once local scams into 
crimes that cross interstate and even international borders. 

Now, while the Internet has tremendous benefits to our society, 
including greater freedom of expression and economic growth, we 
must also recognize that investigators and prosecutors at all levels, 
international, Federal, State, and local, are encountering unique 
challenges, and these include technical challenges that hinder law 
enforcement’s ability to find and to prosecute criminals operating 
online, legal challenges resulting from laws, and legal tools needed 
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to investigate cybercrime lagging behind technological, structural, 
and social changes. 

And third, we face resource challenges that limit our ability to 
focus adequate investigative, prosecutorial, and technical resources 
on cybercrime. Now, in this regard, the Department is seeking an 
additional $37 million in fiscal year 2001 to bolster our cybercrime 
program, including additional resources for the FBI, specially 
trained cyber prosecutors and assistants to State and local law en- 
forcement agencies, but we recognize that Government will not be 
able to solve all of these problems. 

In fact, we believe that the private sector should take the lead 
in protecting private computer networks through more vigilant se- 
curity efforts, information-sharing and, where appropriate, coopera- 
tion with Government agencies. The private sector can and should 
take the lead when improving security practices, and the develop- 
ment of a more secure Internet infrastructure. 

Now, despite the technical, legal, and resource challenges we 
face, the Department has made, we believe, strides in our fight 
against cybercrime. We have and we will continue to develop exten- 
sive investigatory and prosecutorial programs to counter 
cybercrime. We have established the FBI’s National Infrastructure 
Protection Center, NIPC as we call it, and specialized squads lo- 
cated in 16 field offices. From the prosecutorial side, we have 
trained attorneys both at headquarters and in the field who are ex- 
perts in legal technological and practical challenges involved in in- 
vestigating and prosecuting cybercrime. 

As a result of these programs, the number of cases and prosecu- 
tions by the Department is growing at a tremendous rate. For ex- 
ample, in 1998, U.S. Attorneys Offices filed 85 computer crime 
cases against 116 defendants, and this represents a 29-percent in- 
crease in the number of cases filed and a 51-percent increase in the 
number of defendants compared to the previous year. From the 
same period of time a total of 62 cases against 72 defendants were 
terminated, with 78 percent of those defendants being convicted. 

On behalf of the Department, I again want to thank Congress for 
the support it has given to our efforts to combat cybercrime. Ad- 
vancements in technology indicate that our efforts are really only 
just beginning. We look forward to working with Congress and the 
private sector to ensure that we have a robust and effective long- 
term plan for combatting cybercrime, protecting our Nation’s infra- 
structure, safeguarding privacy, and ensuring the Internet reaches 
its full potential for expanding communications, facilitating com- 
merce, and bringing countless other benefits to our society. 

I look forward to responding to your questions. 

[The prepared statement of Mr. Holder follows:] 

Prepared Statement of Eric Holder, Jr., Deputy Attorney General, 

U.S. Department of Justice 

Mr. Chairman, Senator Hollings, and other Members of the Subcommittee, I want 
to thank you for this opportunity to testify on the recent Internet “denial of service” 
attacks and the Federal response to these incidents, with a particular focus on the 
challenges facing the Department of Justice in its fight against cybercrime. At a 
time where new technologies abound and our society becomes increasingly reliant 
on computer networks and thus vulnerable to cybercrime, we look forward to work- 
ing with Congress to ensure that law enforcement, in cooperation with the private 
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sector, can play an appropriate and critical role in protecting the well-being of 
Americans while also respecting fundamental notions of individual privacy that we 
hold dear in this country. 

Comments on the Recent Attacks 

I would be happy to address your questions on the recent attacks, to the extent 
I can do so without compromising our investigation. At this point, I would simply 
say that we are taking the attacks very seriously and that we will do everything 
in our power to identify those responsible and bring them to justice. In addition to 
the malicious disruption of legitimate commerce, so-called “denial of service” attacks 
involve the unlawful intrusion into an unknown number of computers, which are in 
turn used to launch attacks on the eventual target computer, in this case the com- 
puters of Yahoo, eBay, and others. Thus, the number of victims in these types of 
cases can be substantial, and the collective loss and cost to respond to these attacks 
can run into the tens of millions of dollars — or more. 

Overview of Investigative Efforts and Coordination 

Computer crime investigators in a number of FBI field offices and investigators 
from other agencies are investigating these attacks. They are coordinating informa- 
tion with the National Infrastructure Protection Center (NIPC) of the FBI. The 
agents are also working closely with our network of specially trained computer 
crime prosecutors who are available 24 hours a day/7 days a week to provide legal 
advice and obtain whatever court orders are necessary. Attorneys from the Criminal 
Division’s Computer Crime and Intellectual Property Section (CCIPS) are coordi- 
nating with the Assistant United States Attorneys in the field. We are also obtain- 
ing information from victim companies and security experts, who, like many in the 
Internet community, condemn these recent attacks. We are also working closely 
with our counterparts in other nations. I am proud of the efforts being made in this 
case, including the assistance we are receiving from a number of Federal agencies. 

The Emergence of Cybercrime 

It is worth remembering that just ten years ago, the Internet was largely un- 
known and unavailable to the average person. There was no e-commerce, no eBay, 
no Amazon.com. At that time, the Internet was a collection of military, academic, 
and research networks serving a small community of trusted users. That world is 
history. The far-reaching, ever-expanding, and ever more rapid advances in com- 
puter and software technology over the last ten years have combined with the explo- 
sive growth of the Internet to change the world forever. For the most part, the 
Internet and other technologies are providing wonderful benefits to our society — 
from providing new, high-wage jobs to our economy, to expanding educational oppor- 
tunities, improving health care, and allowing family and friends to keep in touch 
in ways that were simply impossible a decade ago. 

Unfortunately, these wonderful technologies also provide new opportunities for 
criminals. Online crime is rapidly increasing. We are seeing more “pure” computer 
crimes, that is, crimes where the computer is used as a weapon to attack other com- 
puters, as we saw in the distributed denial of service attacks I just spoke about, 
and in the spread of malicious code, like viruses. Our vulnerability to this type of 
crime is astonishingly high — it was only this past December that a defendant admit- 
ted, when he pled guilty in Federal and state court to creating and releasing the 
Melissa virus, that he caused over 80 million dollars in damage. These crimes also 
include computer intrusions designed to obtain information of the most sensitive 
sort — such as credit cards, companies’ trade secrets, or individuals’ private informa- 
tion. 

These crimes not only affect our financial well-being and our privacy; they also 
threaten our nation’s critical infrastructure. Our banking system, the stock market, 
the electricity and water supply, telecommunications networks, and critical Govern- 
ment services, such as emergency and national defense services, all rely on com- 
puter networks. For a real-world terrorist to blow up a dam, he would need tons 
of explosives, a delivery system, and a surreptitious means of evading armed secu- 
rity guards. For a cyberterrorist, the same devastating result could be achieved by 
hacking into the control network and commanding the computer to open the flood- 
gates. 

We are also seeing a migration of “traditional” crimes — including threats, child 
pornography, fraud, gambling, and extortion — from the physical to the online world. 
When these crimes are carried out online, perpetrators often find that the can reach 
more victims quickly and quite easily, turning what were once “local” scams into 
crimes that cross interstate and international borders. Computers and computer 
networks provide a cheap and powerful means of communications, and criminals 
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take advantage of this just like everyone else. In addition, sophisticated criminals 
can readily use the easy anonymity that the Internet provides to hide their crimes. 

Challenges of Cybercrime 

The Internet and computers have brought tremendous benefits to our society, in- 
cluding greater freedom of expression and economic growth. But we must also recog- 
nize that as a result of our society’s increasing reliance on technology, investigators 
and prosecutors at all levels — international, Federal, state, and local — are encoun- 
tering unique challenges. These challenges generally can be divided into three cat- 
egories: 

(1) Technical challenges that hinder law enforcement’s ability to find and pros- 
ecute criminals operating online; 

(2) Legal challenges resulting from laws and legal tools needed to investigate 
cybercrime lagging behind technological, structural, and social changes; and 

(3) Resource challenges to ensure we have satisfied critical investigative and 
prosecutorial needs at all levels of Government. 

Before I discuss each of these challenges, let me say that we recognize that we 
in Government will not be able to solve all of these problems. In fact, we believe 
strongly that the private sector should take the lead in protecting private computer 
networks, through more vigilant security efforts, information sharing, and, where ap- 
propriate, cooperation with Government agencies. The private sector has the re- 
sources, the technical ability, and the trained personnel to ensure that, as tech- 
nology continues to develop and change rapidly, the Internet is a safer place for all 
of us. The private sector can and should take the lead on improving security prac- 
tices and the development of a more secure Internet infrastructure. 

However, even assuming that private sector, and the broader Internet community 
as a whole, take steps to provide a safe, secure, and vibrant Internet, there will be 
instances where the practices and safeguards fail. Criminals rob banks even though 
banks use numerous security measures. In such cases, law enforcement must be 
prepared and equipped to investigate and prosecute cybercriminals in order to stop 
their criminal activity, to punish them, and to deter others who might follow the 
same path. This is the reason that it is so important that we work together to ad- 
dress the challenges I am about to discuss. 

Technical Challenges 

When a hacker disrupts air traffic control at a local airport, when a child pornog- 
rapher sends computer files, when a cyberstalker sends a threatening e-mail to a 
public school or a local church, or when credit card numbers are stolen from a com- 
pany engaged in e-commerce, investigators must locate the source of the commu- 
nication. Everything on the Internet is communications, from an e-mail to an elec- 
tronic heist. Finding an electronic criminal means that law enforcement must deter- 
mine who is responsible for sending anelectronic threat or initiating an electronic 
robbery. To accomplish this, law enforcement must in nearly every case trace the 
“electronic trail” leading from the victim back to the perpetrator. 

Tracking a criminal online is not necessarily an impossible task, as demonstrated 
last year when Federal and state law enforcement agencies were able to track down 
the creator of the Melissa virus and the individual who created a false Bloomburg 
News Service website in order to drive up the stock price of PairGain, a tele- 
communications company in California. In both cases, technology enabled us to find 
the individuals who were engaging in criminal activity. 

Unfortunately, despite our successes in the Melissa and PairGain cases, we still 
face significant challenges as online criminals become more sophisticated, often 
wearing the equivalent of Internet electronic gloves to hide their fingerprints and 
their identity. 

It doesn’t take a master hacker to disappear on a network. Ironically, while the 
public is justifiably worried about protecting the legitimate electronic privacy of in- 
dividuals who use networks, a criminal using tools and other information easily 
available over the Internet can operate in almost perfect anonymity. By weaving his 
or her communications through a series of anonymous remailers; by creating a few 
forged e-mail headers with powerful, point-and-click tools readily downloadable from 
many hacker web sites; or by using a “free-trial” account or two, a hacker, online 
pornographer, or web-based fraud artist can often effectively hide the trail of his or 
her communications. 

As we consider the challenge created by anonymity, we must also recognize that 
there are legitimate reasons to allow anonymity in communications networks. A 
whistleblower, a resistance fighter in Kosovo, a battered woman’s support group — 
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all of these individuals may understandably wish to use the Internet and other new 
technologies to communicate with others without revealing their identities. 

In addition to problems related to the anonymous nature of the Internet, we are 
being challenged to investigate and prosecute criminals in an international arena. 
The Internet is a global medium that does not recognize physical and jurisdictional 
boundaries. A criminal no longer needs to be at the actual scene of the crime to prey 
on his or her victims. As a result, a computer server running a web page designed 
to defraud U.S. senior citizens might be located in Europe or Asia. A child pornog- 
rapher may distribute photographs or videos via e-mail, sending the e-mails through 
the communications networks of several countries before they reach their intended 
recipients. With more than 190 Internet-connected countries in the world, the co- 
ordination challenges facing law enforcement are tremendous. And any delay in an 
investigation is critical, as a criminal’s trail might, in certain circumstances, end as 
soon as he or she disconnects from the Internet. 

Likewise, evidence of a crime can be stored at a remote location, either for the 
purpose of concealing the crime from law enforcement and others, or simply because 
of the design of the network. In certain circumstances, the fact that the evidence 
is stored and held by a third party, such as an Internet service provider, might be 
helpful to law enforcement agencies who might be able to use lawful process to get 
that information. However, storing information remotely can also create a challenge 
to law enforcement, which cannot ignore the real-world limits of local, state, and na- 
tional sovereignty and jurisdiction. Obtaining information from foreign countries, es- 
pecially on an expedited basis, can be a daunting task, especially when a country 
may be in a different time zone, use a different language, have different legal rules, 
and may not have trained experts available. Consequently, even as the Internet and 
other new technologies have given us new abilities to find criminals remotely, our 
abilities can be hindered if we cannot obtain the necessary legal cooperation from 
our counterparts in other countries. 

The vast majority of Internet companies are good corporate citizens and are inter- 
ested in the safety of our citizens. In fact, several companies have been engaged in 
discussions with law enforcement regarding our concerns. Despite these efforts, we 
have learned that we cannot take for granted the nature of any Internet service pro- 
vider’s services, its record-keeping practices, and its ability or willingness to cooper- 
ate with us. We have encountered a handful of companies involved in criminal activ- 
ity. In addition, even those companies that are not involved in criminal activities 
might not be able to assist us because of business reasons or privacy concerns that 
have resulted in them not keeping the records that will assist in the investigation 
of a particular crime. 

Moreover, users connect to the Internet from anywhere in the world over old-fash- 
ioned telephone lines, wireless phones, cable modems, and satellite systems. Each 
of these telecommunications systems has its own protocols for addressing and rout- 
ing traffic, which means that tracking all the way back to the criminal at his or 
her computer will require agents to be fluent in each technical language. Gathering 
this evidence from so many kinds of providers is a very different proposition from 
the days when we simply obtained an order for a telephone company to trace a 
threatening call. 

Legal Challenges 

Deterring and punishing computer criminals requires a legal structure that will 
support detection and successful prosecution of offenders. Yet the laws defining com- 
puter offenses, and the legal tools needed to investigate criminals using the Inter- 
net, can lag behind technological and social changes, creating legal challenges to law 
enforcement agencies. 

We may be able to correct some of the legal challenges we encounter through leg- 
islative action. For example, the Computer Fraud and Abuse Act, 18 U.S.C. §1030, 
arguably does not reach a computer hacker who causes a large amount of damage 
to a network of computers if no individual computer sustains over $5,000 worth of 
damage. The Department of Justice has encountered several instances in which in- 
truders have gained unauthorized access to protected computers (whether publicly 
or privately owned) used in the provision of “critical infrastructure” systems and 
services — such as those that hospitals use to store sensitive information and to treat 
patients, and those that the military uses to defend the nation — but where proof of 
damage in excess of $5000 has not been readily available. 

The laws under which we are able to identify the origin and destination of tele- 
phone calls and computer messages also need to be reviewed. For example, under 
current law we may have to obtain court orders in multiple jurisdictions to trace 
a single communication. Obtaining court orders in multiple jurisdictions does not 
advance any reasonable privacy safeguard, yet it can be a substantial impediment 
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to a fast-paced investigation. As the Attorney General testified recently, it might be 
extremely helpful, for instance, to provide nationwide effect for trap and trace or- 
ders. 

Another concern focuses on the problem of online threats and serious harass- 
ment — that is, cyberstalking. Current Federal law does not address those situations 
where a cyberstalker uses unwitting third parties to bombard a victim with mes- 
sages, transmits personal data about a person — such as the route by which the vic- 
tim’s children walk to school — in order to place such person or his family in fear 
of injury, or sends an e-mail or other communications under someone else’s name 
with the intent to abuse, harass, or threaten that person. We believe Federal law 
may need to be amended to address this gap. 

These aren’t hypothetical changes that we are proposing to address. Just ask the 
California woman who was awakened six times in the middle of the night to find 
men knocking on her door offering to rape her. She discovered that a man whom 
she had told she was not romantically interested in had posted personal advertise- 
ments on a variety of Internet services pretending to be her. Each posting, which 
contained her home address and telephone number, claimed that she fantasized 
about being raped. We need to ensure that laws against harassment clearly prohibit 
such horrific actions, particularly since access to the Internet means immediate ac- 
cess to a wide audience. 

While we believe changes in Federal law may be necessary to address these chal- 
lenges, we also want to emphasize that any such legislation should be tailored to 
address the challenges we face and should avoid unnecessary infringement on per- 
sonal privacy. We recognize the importance the public attaches to individual pri- 
vacy, and any legislation must be carefully balanced to avoid unnecessary infringe- 
ment on the privacy rights we hold dear in this country. 

Resource Challenges 

In addition to technical and legal challenges, we face significant resource chal- 
lenges. Simply stated, we need an adequate number of prosecutors and agents — at 
the Federal, state and local level — trained with the necessary skills and properly 
equipped to effectively fight all types of cybercrime. 

While Congress has been very supportive of the Department’s cybercrime efforts, 
we need additional resources to ensure we are adequately equipped to continue our 
battle against cybercriminals. The President has requested $37 million in new 
money in FY 2001 to expand our staffing, training and technological capabilities to 
continue the fight against computer crime. Together, these enhancements will in- 
crease the Department’s 2001 funding base for computer crime to $138 million, 28 
percent more than in 2000. 

Last, the Department of Justice would like to work with Congress to develop a 
comprehensive, five-year plan — with FY 2001 as our baseline — to prevent 
cybercrime and, when it does occur, to locate, identify, apprehend and bring to jus- 
tice those responsible for these types of crimes. On February 16th, the Attorney 
General testified before Congress regarding a proposed a 10-point plan to identify 
the key areas we need to develop for our cybercrime capability. The key points of 
this plan she touched upon include: 

• Developing a round-the-clock network of F ederal, state and local law enforce- 
ment officials with expertise in, and responsibility for, investigating and pros- 
ecuting cybercrime. 

• Developing and sharing expertise — personnel and equipment — among Fed- 
eral, state and local law enforcement agencies. 

• Dramatically increasing our computer forensic capabilities, which are so es- 
sential in computer crime investigations — both hacking cases and cases where 
computers are used to facilitate other crimes, including drug trafficking, ter- 
rorism, and child pornography. 

• Reviewing whether we have adequate legal tools to locate, identify, and pros- 
ecute cybercriminals. In particular, we may need new and more robust proce- 
dural tools to allow state authorities to more easily gather evidence located out- 
side their jurisdictions. We also need to explore whether we have adequate tools 
at the Federal level to effectively investigate cybercrime. 

• Because of the borderless nature of the Internet, we need to develop effective 
partnerships with other nations to encourage them to enact laws that ade- 
quately address cybercrime and to provide assistance in cybercrime investiga- 
tions. A balanced international strategy for combating cybercrime should be at 
the top of our national security agenda. 

• We need to work in partnership with industry to address cybercrime and se- 
curity. This should not be a top-down approach through excessive Government 
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regulation or mandates. Rather, we need a true partnership, where we can dis- 
cuss challenges and develop effective solutions that do not pose a threat to indi- 
vidual privacy. 

• And we need to teach our young people about the responsible use of the 
Internet. The Department of Justice and the Information Technology Associa- 
tion of America have already taken steps to do so through the development of 
the Cybercitizen Partnership, but more needs to be done. 

Efforts Against Cybercrime 

Despite the technical, legal, and resource challenges, the Department has made 
strides in our fight against cybercrime. We have and will continue to develop exten- 
sive investigatory and prosecutorial programs to counter cybercrime. Let me take 
a few moments to details some of our efforts to date. 

On the investigatory side, we have the FBI’s National Infrastructure Protection 
Center (NIPC) and specialized squads located in 16 field offices. 

On the prosecutorial side, we have trained attorneys, both in headquarters and 
in the field, who are experts in the legal, technological, and practical challenges in- 
volved in investigating and prosecuting cybercrime. The cornerstone of our pros- 
ecutor cybercrime program is the Computer Crime and Intellectual Property Sec- 
tion. CCIPS, which currently has 18 attorneys, was founded in 1991 as the Com- 
puter Crime Unit and was elevated to Section status in 1996. CCIPS works closely 
on computer crime cases with Assistant United States Attorneys known as “Com- 
puter and Telecommunications Coordinators” (CTC’s) in U.S. Attorneys’ Offices 
around the country. Each CTC is given special training and equipment, and serves 
as the district’s expert in computer crime cases. As a result of these programs, the 
number of cases and prosecutions by the Department is growing at a tremendous 
rate. For example, in 1998, U.S. Attorneys’ Offices filed 85 computer crime cases 
against 116 defendants. This represents a 29 percent increase in the number of 
cases filed and a 51 percent increase in the number of defendants, compared to the 
previous year. During that same period of time, a total of 62 cases against 72 de- 
fendants were terminated, with 78 percent of those defendants being convicted. 

At the same time, our prosecutors are working with numerous other Federal, 
state, and local investigators and prosecutors, providing assistance in any case in- 
volving computers and other high technology, such as computer searches and sei- 
zure. In sum, the Department and, in particular, its investigators and prosecutors 
take seriously our responsibility to protect the nation’s computers and the Internet 
from computer crime. 

In addition to the Department’s efforts, other agencies including the Customs 
Service, the Secret Service, the Securities and Exchange Commission, and the U.S. 
Postal Service’s Inspectors General, have played a role in the investigation and pros- 
ecution of computer crimes. 

Infrastructure Protection 

The Department is also a full partner in ongoing efforts to assure our nation’s 
critical infrastructures and to make them less vulnerable to the emerging risks of 
the information age. 

I mentioned before that we believe strongly that the private sector should take the 
lead in protecting private computer networks, through more vigilant security efforts, 
information sharing, and, where appropriate, cooperation with Government agencies. 
Within this framework, and apart from prosecuting those who launch criminal at- 
tacks on our infrastructure (which is our critical responsibility), the Department can 
make important contributions. In the information sharing arena, we have continued 
some of the groundwork started by the President’s Commission on Critical Infra- 
structure Protection by more closely examining the issues that may impede robust 
sharing of risk-related information between private sector entities, between Govern- 
mental entities, and between Government and the private sector. 

As the private sector protects its networks, so must the Government. Therefore, 
the Department of Justice is working to ensure that its own networks are secure. 
We are also involved in efforts, under the auspices of the Critical Infrastructure Co- 
ordinating Group of the National Security Council, to help Federal agencies expedite 
and simplify the process of performing “vulnerability assessments,” in order to un- 
cover hidden vulnerabilities of critical Government systems before others try to do 
that for us. 

Finally, the Justice Department also is involved in efforts to ensure that all pro- 
grams arising out of the Federal Government’s “infrastructure assurance” efforts are 
implemented in way entirely respects long-standing protections for the privacy 
rights of individuals. 
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Conclusion 

On behalf of the Department of Justice, I want to thank Congress for all the sup- 
port it has given to our efforts to combat cybercrimes. Advancements in technology 
indicate that our efforts are only just beginning. We look forward to working with 
Congress and the private sector to ensure that we have a robust and effective long- 
term plan for combating cybercrime, protecting our nation’s infrastructure, safe- 
guarding privacy, and ensuring that the Internet reaches its full potential for ex- 
panding communications, facilitating commerce, and bringing countless other bene- 
fits to our society. 

Senator Burns. Thank you very much, Mr. Holder. I appreciate 
that. Now we have Mr. William Reinsch, and Bill, thank you for 
coming back today. We have been across the table many times on 
different issues, and I appreciate your openness and your willing- 
ness to come down and visit with us on issues such as this. We are 
looking forward to your statement. 

STATEMENT OF WILLIAM REINSCH, UNDER SECRETARY OF 

COMMERCE, BUREAU OF EXPORT ADMINISTRATION, 

U.S. DEPARTMENT OF COMMERCE 

Mr. Reinsch. Thank you, Mr. Chairman. It is always a pleasure 
to be here, particularly a pleasure to be here and not talk about 
encryption, so I am delighted to have the opportunity to have a dif- 
ferent subject at hand. 

My statement begins with some comments about the importance 
of computer networks and the Internet, and there is no committee 
that knows more about it than you all, so I think I will just get 
right into the meat of what I want to tell you this morning, Mr. 
Chairman. 

Senator Burns. Your complete statement will be made a part of 
the record, however, Mr. Secretary. 

Mr. Reinsch. I appreciate that. Protecting our critical infrastruc- 
ture requires that we draw on various assets of the Government. 
When specific incidents or cyber events occur, the Government 
needs the capacity to issue warnings, investigate the incident, and 
develop a case to punish the offenders. The National Information 
Protection Center at the FBI is organized to deal with such events 
as they occur. Over the long term, the Government also has a duty 
to be proactive to ensure that our computer systems are protected 
from attack. 

Critical infrastructure protection involves assets of both the Gov- 
ernment and the private sector. A number of agencies have respon- 
sibilities with respect to Government computer systems. The De- 
partment of Defense is well on its way to securing its critical sys- 
tems, and OMB and NIST have responsibility for information re- 
sources management of computer systems in Federal agencies. 

I want to make clear, Mr. Chairman, the Federal Government’s 
responsibility in this area. The commission of crimes is only part 
of the equation. The infrastructures at risk are owned and operated 
by the private sector. The use of information technology is so em- 
bedded in the core operations and customer service delivery sys- 
tems of industry that inevitably it will be they who must work to- 
gether to take the steps necessary to protect themselves. However, 
we can help. 

The first major step is the elevation of awareness across industry 
of the business case for action for leaders within industry. They 
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have a commercial interest in maintaining a secure business envi- 
ronment that assures public confidence in their institutions. We 
can also help identify problems, identify good practices and man- 
agement practices and strategies, publicize them, encourage plan- 
ning, promote research and development, and convene meetings, 
which is not a small matter. 

In short, we can act as a catalyst for industry to mobilize. That 
is precisely the role the Commerce Department is playing in sev- 
eral ways. NTIA is a lead agency for the communications informa- 
tion sector. In February 1999, NTIA created a private sector coordi- 
nator consortium. The consortium is filled by representatives from 
the Information Technology Association of America, the Tele- 
communications Industry Association, and the U.S. Telecom Asso- 
ciation, all groups I am sure you are familiar with. 

Among their initiatives, the consortium has been raising aware- 
ness among industry through the exchange of information on 
threats and vulnerabilities, conducting information security sur- 
veys across sectors, and developing and assessing critical infra- 
structure-related standards and best practices. Perhaps our most 
important area right now is the development of what we are calling 
the Partnership for Critical Infrastructure Security. The partner- 
ship is a collaborative effort between industry and Government. It 
brings representatives of the infrastructure sector together in a di- 
alog with each other and with other stakeholders, including the 
risk management and investment communities, mainstream busi- 
nesses, and also State and local Governments. 

Secretary Daley, Greg Rohde and I met with senior members of 
over 80 partnership companies in New York in December. We met 
again last month in Washington with over 220 senior members of 
more than 120 partnership companies to encourage business lead- 
ers to adopt information security as an integral business practice. 

The partnership agreed to address such important issues as 
cross-sector vulnerability assessments, information-sharing, and 
R&D requirements. It set up working groups in those areas which 
are continuing to meet throughout the spring, and the next meet- 
ing of the full partnership will be this summer. The Department’s 
Critical Infrastructure Assurance Office, or CIAO, also is assisting 
Federal agencies in conducting analyses of their dependencies on 
critical infrastructures. 

CIAO has just finished an ambitious pilot program that identifies 
the critical assets of the Commerce Department and maps out de- 
pendencies on Governmental and private sector infrastructures. 
This program will provide important input to managers and secu- 
rity officials as they seek to assure their critical assets against 
cyber attacks. The Commerce Department through the CIAO also 
coordinated the development of the national plan for information 
systems protection. President Clinton announced the release of 
version 1.0 of the plan on January 7. This is it. If you do not have 
any, I would be pleased to provide you with thousands of them. 

It represents the first attempt by any national Government to 
design a way to protect those infrastructures essential to the deliv- 
ery of electric power, oil and gas, communications, transportation 
services, banking and financial services, and vital human services. 
Increasingly, these infrastructures are being operated and con- 
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trolled through the use of computers and computer networks. My 
full statement, Mr. Chairman, has substantial information about 
the details of the plan that I will pass over in the interest of time. 

Finally, let me make a comment about funding. President Clin- 
ton has proposed increases for critical infrastructure protection 
substantially over the past 3 years, including a 15 percent increase 
in his fiscal year 2001 budget to $2.01 billion. He has also devel- 
oped and funded new initiatives to defend the Nation’s systems 
from cyber attack. For example, establishing a permanent export 
review team at NIST that will help agencies conduct vulnerability 
analyses and develop critical infrastructure protection plans, work- 
ing to recruit, train, and retrain Federal information technology ex- 
perts. 

We have developed and provided fiscal year 2001 funding for a 
Federal cyber services training and education initiative led by OPM 
and the National Science Foundation, which calls for two programs. 
The first is an ROTC-like program, where we pay for information 
technology education in exchange for Federal service, and the sec- 
ond is a program to establish competencies and to certify our exist- 
ing IT work force. As I think you, Mr. Chairman, or Senator Hol- 
lings commented that obtaining and retraining information tech- 
nology workers in the Federal Government, whether it is in the law 
enforcement area or on the civilian side, is an extremely difficult 
thing to do. 

We think this program will be an important first step, in addi- 
tion to funding seven public key infrastructure model pilot pro- 
grams in fiscal year 2001 at different Federal agencies, designing 
a Federal intrusion detection network, or FIDNET, to protect vital 
systems in Federal civilian agencies, and ensuring the rapid imple- 
mentation of system patches for known software defects. FIDNET 
will operate in full compliance with all existing privacy laws. 

Developing Federal R&D efforts. R&D investments in computer 
security will grow by 31 percent in the President’s fiscal year 2001 
budget. Part of that includes establishing an Institute for Informa- 
tion Infrastructure Protection in NIST, as recommended by the 
President’s Committee of Advisors on Science and Technology, or 
PiCAST. 

The institute would identify and address serious R&D gaps that 
neither the private sector nor the Government’s national security 
community would otherwise address, but that are necessary to en- 
sure the robust, reliable operation of the national information in- 
frastructure. The President’s 2001 budget provides $150 million for 
the institute. 

Finally, the National Infrastructure Assurance Council, NIAC. 
The President signed an executive order creating this advisory 
council last year. Its members are now being recruited from the 
senior ranks of the critical infrastructure industries, including the 
information technology, State and local Governments, and we ex- 
pect an announcement about that shortly. 

In addition, the President has announced a number of new initia- 
tives designed to support efforts for enhancing computer security, 
including the $9 million fiscal year 2000 budget supplemental that 
jump starts several of the key elements of next year’s budget that 
I just mentioned. 
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In closing, Mr. Chairman, let me simply say that in early Feb- 
ruary Secretary Daley met with the President and 25 senior execu- 
tives concerned about the recent disruptions to the Internet. This 
meeting reinforced the need for further cooperation between Gov- 
ernment and industry to help the private sector to develop its ac- 
tion agenda for cyber security. The incidents of early February are 
not cause, in our judgment, for pushing the panic button, but they 
are a wake-up call for action. 

As the President said, I think there is a way that we can clearly 
promote security. The President submitted a budget proposal that 
funds a number of initiatives that address critical information sys- 
tems protection. If we are to reap the benefits of the information 
age, we need to take action to maintain public confidence in a se- 
cure business environment that ensures both our national security 
and the growth of our economy. 

Thank you, Mr. Chairman. 

[The prepared statement of Mr. Reinsch follows:] 

Prepared Statement of William Reinsch, Under Secretary of Commerce, 
Bureau of Export Administration, U.S. Department of Commerce 

Mr. Chairman, I welcome this opportunity to appear before you to discuss the 
Federal Government’s efforts to protect the nation’s critical infrastructures. 

Interdependent computer networks are an integral part of doing business in the 
Information Age. America is increasingly dependent upon computer networks for es- 
sential services, such as banking and finance, emergency services, delivery of water, 
electricity and gas, transportation, and voice and data communications. New ways 
of doing business in the 21st century are rapidly evolving. Business is increasingly 
relying on E-commerce for its commercial transactions as well as for its critical op- 
erations. At the same time, recent hacking attempts at some of the most popular 
commercial Web sites underscore that America’s information infrastructure is an at- 
tractive target for deliberate attack or sabotage. These attacks can originate from 
a host of sources, such as terrorists, criminals, hostile nations, or the equivalent of 
car thief “joyriders.” Regardless of the source, however, the potential for cyber dam- 
age to our national security and economy is evident. 

Protecting our critical infrastructures requires that we draw on various assets of 
the Government. When specific incidents or cyber events occur, the Government 
needs a capacity to issue warnings, investigate the incident, and develop a case to 
punish the offenders. The National Information Protection Center at the FBI is or- 
ganized to deal with such events as they occur. 

Over the long term, the Government also has a duty to be proactive to ensure 
that our computer systems are protected from attack. Critical infrastructure protec- 
tion involves assets of both the Government and the private sector. A number of 
agencies have responsibilities with respect to Government computer systems. The 
Department of Defense is well on its way to securing its critical systems, and the 
Office of Management and Budget (OMB) and the National Institute of Standards 
and Technology at the Department of Commerce (NIST) have responsibility for in- 
formation resources management of computer systems in Federal agencies. 

I want to make clear that the Federal Government’s responsibility in this area 
with respect to the commission of crimes is only part of the equation. The infra- 
structures at risk are owned and operated by the private sector. The use of informa- 
tion technology is so embedded in the core operations and customer service delivery 
systems of industry that inevitably, it will be they who must work together to take 
the steps necessary to protect themselves. We can help. The first major step is the 
elevation of awareness across industry of the “business case for action” for leaders 
within industry. They have a commercial interest in maintaining a secure business 
environment that assures public confidence in their institutions. We can also help 
identify problems, good practices in management policies and strategies, and pub- 
licize them, encourage planning, promote research and development, convene meet- 
ings. In short, we can act as a catalyst for industry to mobilize. That is precisely 
the role the Commerce Department is playing in several ways. 

First, the National Telecommunications and Information Administration (NTIA) 
is lead agency for the communications and information sector. In February, 1999, 
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NTIA created a Private Sector Coordinator Consortium. This role is filled by rep- 
resentatives from the Information Technology Association of America (ITAA), the 
Telecommunications Industry Association (TIA), and the U.S. Telecom Association 
(USTA). Among their initiatives, the consortium has been raising awareness among 
industry through the exchange of information on threats and vulnerabilities, con- 
ducting information security surveys across sectors, and developing and asessing 
CIP-related standards and best practices. 

Another active area is the development of the Partnership for Critical Infrastruc- 
ture Security. The Partnership is a collaborative effort between industry and Gov- 
ernment. This undertaking brings representatives of the infrastructure sectors to- 
gether in a dialogue with each other and with other stakeholders, including the risk 
management and investment communities, mainstream businesses, and state and 
local Governments. 

The Partnership complements the work of the Federal lead agencies responsible 
for working directly with the industry sectors in developing their critical infrastruc- 
ture plans, including NTIA’s work with the communications and information tech- 
nology industries. It also complements the NIPC’s focus on cyber-terrorism by en- 
couraging industry to collaborate on information security issues. 

Secretary Daley, Assistant Secretary for Communications and Information Greg- 
ory Rohde, and I met with senior members of over 80 Partnership companies in De- 
cember in New York. We met again last month in Washington, D.C., with over 220 
senior members of more than 120 Partnership companies to encourage business 
leaders to adopt information security as an integral business practice. The Partner- 
ship agreed to address such important issues as, cross-sector vulnerability assess- 
ments, information sharing, and R&D requirements. 

The Commerce Department’s Critical Infrastructure Assurance Office (CIAO) also 
is assisting Federal agencies in conducting analyses of their own dependencies on 
critical infrastructures. CIAO has just finished an ambitious pilot program that 
identifies the critical assets of the Commerce Department and maps out depend- 
encies on Governmental and private sector infrastructures. This program will pro- 
vide important input to managers and security officials as they seek to assure their 
critical assets against cyber attacks. 

The Commerce Department, through the CIAO, coordinated the development of 
the National Plan for Information Systems Protection. President Clinton announced 
the release of Version 1.0 of the Plan on January 7. 

It represents the first attempt by any national Government to design a way to 
protect those infrastructures essential to the delivery of electric power, oil and gas, 
communications, transportation services, banking and financial services, and vital 
human services. Increasingly, these infrastructures are being operated and con- 
trolled through the use of computers and computer networks. 

The current version of the Plan focuses mainly on the domestic efforts being un- 
dertaken by the Federal Government to protect the Nation’s critical cyber-based in- 
frastructures. Later versions will focus on the efforts of the infrastructure owners 
and operators, as well as the risk management and broader business community. 
Subsequent versions will also reflect to a greater degree the interests and concerns 
expressed by Congress and the general public based on their feedback. That is why 
the Plan is designated Version 1.0 and subtitled An Invitation to a Dialogue — to in- 
dicate that it is still a work in progress and that a broader range of perspectives 
must be taken into account if the Plan is truly to be “national” in scope and treat- 
ment. 

II. The Plan: Overview and Highlights. 

President Clinton directed the development of this Plan to chart the way toward 
the attainment of a national capability to defend our critical infrastructures by the 
end of 2003. To meet this ambitious goal, the Plan establishes 10 programs for 
achieving three broad objectives. They are: 

Objective 1: Prepare and Prevent: Undertake those steps necessary to mini- 
mize the possibility of a significant and successful attack on our critical information 
networks, and build an infrastructure that remains effective in the face of such at- 
tacks. 

Program 1 calls for the Government and the private sector to identify significant 
assets, interdependencies, and vulnerabilities of critical information networks from 
attack, and to develop and implement realistic programs to remedy the 
vulnerabilities, while continuously updating assessment and remediation efforts. 
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Objective 2: Detect and Respond: Develop the means required to identify and 
assess attacks in a timely way, contain such attacks, recover quickly from them, and 
reconstitute those systems affected. 

Program 2 will install multi-layered protection on sensitive computer systems, in- 
cluding advanced fire walls, intrusion detection monitors, anomalous behavior iden- 
tifiers, enterprise-wide management systems, and malicious code scanners. To pro- 
tect critical Federal systems, computer security operations centers will receive warn- 
ings from these detection devices, as well as Computer Emergency Response Teams 
(CERTs) and other means, in order to analyze the attacks, and assist sites in defeat- 
ing attacks. 

Program 3 will develop robust intelligence and law enforcement capabilities to pro- 
tect critical information systems, consistent with the law. It will assist, transform, 
and strengthen U.S. law enforcement and intelligence agencies to be able to deal 
with a new kind of threat and a new kind of criminal — one that acts against com- 
puter networks. 

Program 4 calls for a more effective nationwide system to share attack warnings 
and information in a timely manner. This includes improving information sharing 
within the Federal Government and encouraging private industry, as well as, state 
and local Governments, to create Information Sharing and Analysis Centers 
(ISACs), which would share information among corporations and state and local 
Governments, and could receive warning information from the Federal Government. 
Program 4 additionally calls for removal of existing legal barriers to information 
sharing. 

Program 5 will create capabilities for response, reconstitution, and recovery to limit 
an attack while it is underway and to build into corporate and agency continuity 
and recovery plans the ability to deal with information attacks. The goal for Govern- 
ment and the recommendation for industry is that every critical information system 
have a recovery plan in place that includes provisions for rapidly employing addi- 
tional defensive measures (e.g., more stringent firewall instructions), cutting off or 
shutting down parts of the network under certain predetermined circumstances 
(through.enterprise-wide management systems), shifting minimal essential oper- 
ations to “clean” systems, and to quickly reconstitute affected systems. 

Objective 3: Build Strong Foundations: Take all actions necessary to create 
and support the Nation’s commitment to Prepare and Prevent and to Detect and Re- 
spond to attacks on our critical information networks. 

Program 6 will systematically establish research requirements and priorities needed 
to implement the Plan, ensure funding, and create a system to ensure that our in- 
formation security technology stays abreast with changes in the threat environment. 

Program 7 will survey the numbers of people and the skills required for information 
security specialists within the Federal Government and the private sector, and 
takes action to train current Federal IT workers and recruit and educate additional 
personnel to meet shortfalls. 

Program 8 will explain publicly the need to act now, before a catastrophic event, 
to improve our ability to defend against deliberate cyber-based attacks. 

Program 9 will develop the legislative framework necessary to support initiatives 
proposed in other programs. This action requires intense cooperation within the 
Federal Government, including Congress, and between the Government and private 
industry. 

Program 10 builds mechanisms to highlight and address privacy issues in the devel- 
opment of each and every program. Infrastructure assurance goals must be accom- 
plished in a manner that maintains, and even strengthens, American’s privacy and 
civil liberties. The Plan outlines nine specific solutions, which include consulting 
with various communities; focusing on and highlighting the impact of programs on 
personal information; committing to fair information practices and other solutions 
developed by various working groups in multiple industries; and working closely 
with Congress to ensure that each program meets standards established in existing 
Congressional protections. 

With respect to funding, President Clinton has proposed increases for critical in- 
frastructure protection substantially over the past three years, including a 15 per- 
cent increase in his FY 2001 budget to $2.01 billion. He has also developed and 
funded new initiatives to defend the nation’s systems from cyber attack: 
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• Establishing a permanent Expert Review Team (ERT) at NIST that will help 
agencies conduct vulnerability analyses and develop critical infrastructure protec- 
tion plans. ($5 million). 

• Working to recruit, train, and retrain Federal IT Experts. We have developed 
and provided FY2001 funding for a Federal Cyber Services Training and Education 
initiative led by OPM and NSF which calls for two programs: the first is an ROTC- 
like program where we pay for IT education (B.S. or M.S.) in exchange for Federal 
service; and the second is a program to establish competencies and certify our exist- 
ing IT workforce. ($25 million). 

• Funding seven Public Key Infrastructure model pilot programs in FY 2001 at dif- 
ferent Federal agencies. ($7 million). 

• Designing a Federal Intrusion Detection Network (FIDNET) to protect vital sys- 
tems in Federal civilian agencies, and in ensuring the rapid implementation of sys- 
tem “Apaches” for known software defects. FIDNET will operate in full compliance 
with all existing privacy laws. ($10 million). 

• Developing Federal R&D Efforts. R&D investments in computer security will 
grow by 31 percent in the FY 2001 budget. ($606 million). 

• Establishing an Institute for Information Infrastructure Protection. The Institute 
would identify and address serious R&D gaps that neither the private sector nor 
the Government’s national security community would otherwise address, but that 
are necessary to ensure the robust, reliable operation of the national information 
infrastructure. The President’s FY2001 budget provides funding of $50 million for 
the Institute. Funding would be provided through the Commerce Department’s Na- 
tional Institute of Standards and Technology (NIST) to this organization. The Insti- 
tute was first proposed by the scientists and corporate officials who served on the 
President’s Committee of Advisors on Science and Technology, and supported by 
leading corporate Chief Technology officers. ($50 million). 

• National Infrastructure Assurance Council (NIAC). The President signed an Ex- 
ecutive order creating this Advisory Council last year. Its members are now being 
recruited from senior ranks of the critical infrastructure industries, including the in- 
formation technology, and state and local Governments. 

In addition, the President announced a number of new initiatives designed to sup- 
port efforts for enhancing computer security, including a $9 million FY 2000 budget 
supplemental to jump-start key elements of next year’s budget. 

In early February, Secretary Daley met with the President and 25 senior execu- 
tives concerned about the recent disruptions to the Internet. This meeting reinforced 
the need for further cooperation between Government and industry to help the pri- 
vate sector develop its action agenda for cyber security. The incidents of early Feb- 
ruary are not cause for pushing the panic button, but they are a wake up call for 
action. As the President said, “I think there is a way that we can clearly promote 
security.” The President has submitted a budget proposal that funds a number of 
initiatives that address critical information systems protection. If we are to reap the 
benefits of the Information Age, we need to take action to maintain public con- 
fidence in a secure business environment that ensures both our national security 
and the growth of our economy. 

Senator BURNS. Thank you, Mr. Secretary. Now we hear from 
Mr. Michael Vatis, Deputy Assistant Director of the FBI here in 
Washington, D.C. It is nice to have you with us this morning. 

STATEMENT OF MICHAEL A. VATIS, DEPUTY ASSISTANT 

DIRECTOR, FEDERAL BUREAU OF INVESTIGATION, 

NATIONAL INFRASTRUCTURE PROTECTION PROGRAMS 

Mr. Vatis. Thank you, Mr. Chairman, Senator Hollings and 
members of the Subcommittee. I want to thank you for inviting me 
here to discuss the growing problem of cybercrime and its impact 
on commerce. Our ability in law enforcement to deal with this 
growing crime problem will require the support of Congress, and I 
greatly appreciate your support, Mr. Chairman, and this Commit- 
tee’s support for the work that we have been about these last 2 
years. 

The recent denial of service attacks have thrust the security of 
our information infrastructure into the spotlight, but they are real- 
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ly only the most recent example of a large and growing problem of 
criminal activity in cyberspace. The cyber revolution has permeated 
many aspects, if not all aspects, of our lives, and we see its effects 
all around us, in the way we do business, in the way we commu- 
nicate, and even in the way that Government agencies operate. 

Unfortunately, that revolution has a downside, as you mentioned 
in your own statement, Mr. Chairman, and that downside is the ef- 
fect that cyberspace and the new information technologies have on 
criminal activity, because criminals are increasingly seeing the 
utility of cyber tools both to facilitate traditional sorts of crimes 
like fraud schemes and extortion, and also to engage in new types 
of crimes, where computers and the information stored on them are 
seen as the targets of the criminal activity, rather than just 
facilitators of that activity. 

Thus, we have seen criminals intruding into computers to steal 
credit cards, to steal money, to abscond with proprietary informa- 
tion, and to shut down e-commerce sites. And this is not just a 
crime problem. It is also a national security problem. That is be- 
cause our Nation’s critical infrastructures — including things such 
as telecommunications, electrical energy, and banking and finance, 
those things that are vital to our national security as well as our 
national economy — are all dependent on computer technology. But 
that very dependence makes them vulnerable to sorts of attacks 
that did not exist 10 or 15 years ago. 

So the same basic types of cyber tools that are attractive now to 
criminals who are interested in illicit financial gain are also attrac- 
tive to foreign intelligence services who might be seeking ways to 
obtain sensitive Government or private sector information, and also 
to terrorists or hostile foreign nations who are bent on attacking 
United States interests. 

The difficulty of dealing with this challenge stems from the na- 
ture of the cyber environment itself. That environment is border- 
less. It affords easy anonymity and methods of concealment to bad 
actors, and it provides new tools that allow remote access to tar- 
geted computers. A criminal sitting on the other side of the planet 
is just as capable of stealthily infiltrating a computer network, or 
shutting an e-commerce site down, as is somebody sitting across 
the street from his target. 

To deal with this problem in all its novel aspects, law enforce- 
ment must retool its work force, forge new partnerships with pri- 
vate industry and other agencies, and also work closely with our 
international counterparts, because so many of these events tran- 
scend national boundaries. 

We have been doing all of these things for the last two years at 
the NIPC, but we must ensure that we can continue to build on 
our progress to ensure that we can protect the Nation’s public safe- 
ty and national security in the information age. 

As you know, the NIPC is an interagency center located at the 
FBI, and we serve as a focal point for the Government’s efforts, on 
the one hand, to warn of imminent or impending attacks, and also, 
on the other hand, to respond to any attacks that do occur. Regard- 
ing the number of our personnel, we have 94 authorized FBI posi- 
tions at the NIPC, and we have 82 of those 94 people on board, 
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with the other dozen people in the pipeline and scheduled to come 
on board shortly. 

We have a target of 40 detailees from other Government agen- 
cies — which is simply a target, since we are left, really, to the be- 
neficence of other agencies to send people over to us to work with 
us, and we have got about half of our target on board, with some 
candidates in the pipeline as well that will come from those other 
agencies. But one of our challenges is to work with other agencies 
to get some people who have the right skills. Unfortunately there 
is a limited supply of those people in the Government, but we are 
working effectively with other agencies to ensure that they are rep- 
resented at the Center, so we can build a good operational partner- 
ship. 

We also have, in addition to the Center itself, an investigative 
program across the FBI field offices around the Nation, which con- 
sists of 193 special agents who are trained in conducting network 
investigations and who also engage in critical liaison with the pri- 
vate sector, and, very importantly, with State and local law en- 
forcement, since they obviously must bear a large share of the load 
in dealing with this crime problem. 

My written statement has a lengthy summary of examples of the 
many different types of cybercrime that we have dealt with over 
the last two years. I will mention here just two recent examples 
which I think point out the challenge and also the effects of 
cybercrime on e-commerce. Last Fall, we had the Melissa virus, 
which was a very quickly disseminating virus that affected numer- 
ous, customers and businesses. Within several days, working with 
AOL and the New Jersey State police, we were able to track down 
the propagator of that virus, and he recently pled guilty to both 
Federal and State charges. In his guilty plea, he admitted to affect- 
ing over a million computers and causing $80 million in damage 
from that one virus. 

Then in February of this year, we had the distributed denial of 
service (DDOS) attacks on some of the most popular e-commerce 
sites, as the Deputy Attorney General mentioned. I, too, am limited 
in what I can say here about this pending investigation, but I can 
make a couple of points. First, even before the investigation, at the 
end of last year, when we had information that some of the mali- 
cious DDOS software was being implanted in universities and 
other private sector networks that would allow a hacker to take 
over those systems and use them to attack another target, we 
issued warnings to Government agencies and to the private sector 
so that people could take steps to see whether their own networks 
had been taken over without their knowledge, and so that they 
could remove any malicious code. 

We also released a detection tool that we had created mainly for 
investigative uses, but which we also realized had possible utility 
for network protection. We made that tool available to private com- 
panies and Government agencies so that they could determine 
whether their networks had been taken over by a hacker. 

Unfortunately, those efforts did not totally eliminate the threat, 
and at the beginning of last month we did see numerous sites being 
taken offline for several hours. As a result, we have initiated sev- 
eral investigations across the country. We have numerous special 
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agents following leads. We are also working very closely with sev- 
eral international counterparts to follow leads in their countries. 
Although I cannot go into detail, I can say we are making excellent 
progress. I am very satisfied with the progress we are making, and 
I am optimistic about the likelihood of having a successful resolu- 
tion of at least some of these investigations. 

Addressing the threat of cybercrime requires teamwork. That is 
the bottom line. We have to have good teamwork among Federal 
agencies, good teamwork between Federal and State and local law 
enforcement, and good teamwork between the Government and pri- 
vate sector. 

We have developed partnerships with all of those other sectors 
over the last two years, and the one with the private sector is par- 
ticularly important. Most of the victims of cybercrime are private 
companies, so successful investigation really depends on private 
companies letting us know when they have been victimized and 
working with us to provide us with incident information, and some- 
times with technical assistance so that we can pursue investiga- 
tions to the end. 

The network administrator in a private company is oftentimes in 
many ways the lead investigator, because he or she is the one who 
really knows how his or her network is set up, and can lead an 
agent through the thicket of the network and come up with the im- 
portant information that is necessary to an investigation. 

I think the number of companies that have reported to us and 
have cooperated with us in the DDOS investigations is proof of the 
fact that private companies are realizing that they have to deal 
with law enforcement, and they are willing to engage in a good, co- 
operative venture with us. One of the keys to having a successful 
relationship with the private sector is for us to be able to dem- 
onstrate that we are capable of investigating these sorts of crimes. 
I think our track record over the last two years has shown that 
competence, and shown that we know how to investigate these 
cases, and our training efforts are enhancing our ability to do that. 

We also need to show that we are willing to give information 
back to the private sector. We do not just want them to report to 
us. We are capable and willing to give them warnings when we 
have relevant information, and also to give them information about 
the nature of the threat and some of the technical exploits that we 
are seeing bad guys use. We have a number of programs that are 
geared toward sharing that information back to the private sector, 
which in turn is helping us to generate the confidence on the pri- 
vate sector’s part that they can work with us. 

I think it is a truism that commerce does not thrive in anarchy, 
and as Internet use soars, and e-commerce becomes a more signifi- 
cant part of our overall economy, it is in our national interest to 
ensure that the conditions exist that will foster the further growth 
of e-commerce. One of the conditions for that growth is enhancing 
the security of e-commerce sites so that customers can be confident 
that their privacy will be protected and that their credit cards will 
not be stolen, and so that businesses can be assured that they will 
not be knocked offline or robbed by cyber criminals. 

Law enforcement has a significant role to play in fostering that 
security and ensuring that that confidence exists in cyberspace just 
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as in the physical world. It is important that we maintain and en- 
hance our investigation capabilities to help establish that con- 
fidence and raise the level of security. We are only a part of the 
task, and the private sector bears the lion’s share of the load in es- 
tablishing better security on their own systems. But our role is a 
significant one, and we are very much tending to the business of 
ensuring that we can meet the challenge. I look forward to working 
with you, Mr. Chairman, and this Subcommittee to ensure that we 
continue to meet that threat. 

Thank you very much. 

[The prepared statement of Mr. Vatis follows:] 

Prepared Statement of Michael A. Vatis, Deputy Assistant Director, 

Federal Bureau of Investigation, National Infrastructure Protection 

Programs 

Introduction 

Mr. Chairman, Senator Hollings, and Members of the Subcommittee: Thank you 
for inviting me to discuss the threats to our Nation’s critical infrastructures and the 
NIPC’s approach to meeting those challenges. In 1998 the National Infrastructure 
Protection Center (NIPC) was established as a focal point for the Federal Govern- 
ment’s efforts to protect the critical infrastructures. Much has happened since then 
to demonstrate both the wisdom of establishing such a Center and the seriousness 
of the problem it was designed to address. In the last two years we have seen the 
spread of destructive computer viruses affecting millions of users, a major inter- 
national intrusion into Government computer networks, and denial-of-service at- 
tacks against some of the most popular e-commerce websites. Today I will focus on 
the nature of the national security and criminal threats we face in cyberspace, the 
progress we have made with our interagency partners in meeting those threats, and 
the continuing challenges we face. 

The NIPC 

The NIPC is an interagency Center located at the FBI. Created in 1998, the NIPC 
serves as the focal point for the Government’s efforts to warn of and respond to 
cyber attacks, particularly those that are directed at our nation’s “critical infrastruc- 
tures.” These infrastructures include telecommunications and information, energy, 
banking and finance, transportation, Government operations, and emergency serv- 
ices. In Presidential Decision Directive (PDD) 63, the President directed that the 
NIPC serve as a “national critical infrastructure threat assessment, warning, vul- 
nerability, and law enforcement investigation and response entity.” The PDD fur- 
ther states that the mission of the NIPC “will include providing timely warnings 
of intentional threats, comprehensive analyses and law enforcement investigation 
and response.” 

To accomplish its goals, the NIPC is organized into three sections: 

The Computer Investigations and Operations Section (CIOS) is the operational re- 
sponse arm of the Center. It supports and, where necessary, coordinates computer 
investigations conducted by FBI field offices and other agencies throughout the 
country, provides expert technical assistance to network investigations, and provides 
a cyber emergency response capability to coordinate the response to a national-level 
cyber incident. 

The Analysis and Warning Section (AWS) serves as the “indications and warning” 
arm of the NIPC. It provides tactical analytical support during a cyber incident, and 
also develops strategic analyses of threats for dissemination to both Government 
and private sector entities so that they can take appropriate steps to protect them- 
selves. Through its 24/7 watch and warning operation, it maintains a real-time situ- 
ational awareness by reviewing numerous Governmental and “open” sources of in- 
formation and by maintaining communications with partner entities in the Govern- 
ment and private sector. Through its efforts, the AWS strives to acquire indications 
of a possible attack, assess the information, and issue appropriate warnings to Gov- 
ernment and private sector partners as quickly as possible 

The Training, Outreach and Strategy Section (TOSS) coordinates the vital train- 
ing of cyber investigators in the FBI field offices, other Federal agencies, and state 
and local law enforcement. It also coordinates outreach to private industry and Gov- 



24 


ernment agencies to build the partnerships that are key to both our investigative 
and our warning missions. In addition, this section manages our efforts to catalogue 
information about individual “key assets” across the country which, if successfully 
attacked, could have significant repercussions on our economy or national security. 
Finally, the TOSS handles the development of strategy and policy in conjunction 
with other agencies and the Congress. 

Beyond the NIPC at FBI Headquarters, we have also created a cybercrime inves- 
tigative program in all FBI Field Offices called the National Infrastructure Protec- 
tion and Computer Intrusion (NIPCI) Program. This program, managed by the 
NIPC, consists of special agents in each FBI Field Office who are responsible for 
investigating computer intrusions, viruses, or denial of service attacks, for imple- 
menting our key asset initiative, and for conducting critical liaison activities with 
private industry. They are also developing cybercrime task forces in partnership 
with state and local law enforcement entities within their jurisdiction to leverage 
the limited resources in this area. 

The Broad Spectrum of Threats 

Over the past several years we have seen a wide range of cyber threats ranging 
from defacement of websites by juveniles to sophisticated intrusions that we suspect 
may be sponsored by foreign powers, and everything in between. Some of these are 
obviously more significant than others. The theft of national security information 
from a Government agency or the interruption of electrical power to a major metro- 
politan area would have greater consequences for national security, public safety, 
and the economy than the defacement of a web-site. 

But even the less serious categories have real consequences and, ultimately, can 
undermine confidence in e-commerce and violate privacy or property rights. A web 
site hack that shuts down an e-commerce site can have disastrous consequences for 
a business. An intrusion that results in the theft of credit card numbers from an 
online vendor can result in significant financial loss and, more broadly, reduce con- 
sumers’ willingness to engage in e-commerce. Recent surveys confirm this point. Ac- 
cording to a poll of Internet users by PC Data Online, 90 percent of those surveyed 
are concerned about the recent denial of service attacks. One in three surveyed said 
they were affected by the DDOS attacks. Further, over 40 percent of those surveyed 
said that they would be less likely to send credit card information over the Internet 
in the future. 

Such surveys demonstrate the simple fact that the Internet has become a major 
aspect of everyday life for many Americans and is fast becoming a major part of 
our economy. There were over 100 million Internet users in the United States in 
1999. That number is projected to reach 177 million in the United States and 502 
million worldwide by the end of 2003. Electronic commerce has emerged as a new 
sector of the American economy, accounting for over $100 billion in sales during 
1999, more than double the amount in 1998. By 2003, electronic commerce is pro- 
jected to exceed $1 trillion. It should be no surprise, then, that as Internet use and 
e-commerce continue to grow at a rapid pace, the rate of cybercrime is also rising 
dramatically. 

A significant part of the problem is the lack of adequate security on the Internet. 
As Lou Gerstner, the CEO of IBM said in a speech at Boston College on Monday, 
“No brick-and-mortar company would ever consider opening its doors without locks, 
video cameras and a security staff. Yet every day hundreds of Web enterprises do 
just that.” A fundamental need, therefore, is to raise the level of security on the 
Internet. This is clearly the role of the private sector. The Government has neither 
the responsibility nor the expertise to act as the private sector’s system adminis- 
trator. We can help, however, by providing information to the private sector about 
concrete threats and the latest techniques being utilized by cyber criminals, so that 
private companies can take steps to secure their systems against those threats. We 
also need to ensure that law enforcement has the capabilities to investigate 
cybercrime that does occur. 

The following are some of the categories of cyber threats that we confront today. 

Insiders. The disgruntled insider (a current or former employee of a company) is 
a principal source of computer crimes for many companies. Insiders’ knowledge of 
the target companies’ network often allows them to gain unrestricted access to cause 
damage to the system or to steal proprietary data. The 1999 Computer Security In- 
stitute/FBI report notes that 55 percent of respondents reported malicious activity 
by insiders. 

One example of an insider was George Parente. In 1997, Parente was arrested 
for causing five network servers at the publishing company Forbes, Inc., to crash. 
Parente was a former Forbes computer technician who had been terminated from 
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temporary employment. In what appears to have been a vengeful act against the 
company and his supervisors, Parente dialed into the Forbes computer system from 
his residence and gained access through a co-worker’s log-in and password. Once on- 
line, he caused five of the eight Forbes computer network servers to crash, and 
erased all of the server volume on each of the affected servers. No data could be 
restored. Parente’s sabotage resulted in a two day shut down in Forbes’ New York 
operations with losses exceeding $100,000. Parente pleaded guilty to one count of 
violating of the Computer Fraud and Abuse Act, Title 18 U.S.C. 1030. 

Hackers. Hackers (or “crackers”) are also a common threat. They sometimes crack 
into networks simply for the thrill of the challenge or for bragging rights in the 
hacker community. Recently, however, we have seen more cases of hacking for illicit 
financial gain or other malicious purposes. While remote cracking once required a 
fair amount of skill or computer knowledge, hackers can now download attack 
scripts and protocols from the World Wide Web and launch them against victim 
sites. Thus while attack tools have become more sophisticated, they have also be- 
come easier to use. The distributed denial-of-service (DDOS) attacks earlier this 
month are only the most recent illustration of the economic disruption that can be 
caused by tools now readily available on the Internet. 

We have also seen a rise recently in politically motivated attacks on web pages 
or email servers, which some have dubbed “hacktivism.” In these incidents, groups 
and individuals overload e-mail servers or deface web sites to send a political mes- 
sage. While these attacks generally have not altered operating systems or networks, 
they have disrupted services, caused monetary loss, and denied the public access to 
websites containing valuable information, thereby infringing on others’ rights to dis- 
seminate and receive information. 

Virus Transmitters. Virus transmitters are posing an increasingly serious threat 
to networks and systems worldwide. Last year saw the proliferation of several de- 
structive computer viruses or “worms,” including the Melissa Macro Virus, the Ex- 
plore.Zip worm, and the CIH (Chernobyl) Virus. The NIPC frequently sends out 
warnings or advisories regarding particularly dangerous viruses, which can allow 
potential victims to take protective steps and minimize the destructive consequences 
of a virus. 

The Melissa Macro Virus was a good example of our two-fold response — encom- 
passing both warning and investigation — to a virus spreading in the networks. The 
NIPC sent out warnings as soon as it had solid information on the virus and its 
effects; these warnings helped alert the public and reduce the potential destructive 
impact of the virus. On the investigative side, the NIPC acted as a central point 
of contact for the field offices who worked leads on the case. A tip received by the 
New Jersey State Police from America Online, and their follow-up investigation 
with the FBI’s Newark Division, led to the April 1, 1999 arrest of David L. Smith. 
Mr. Smith pleaded guilty to one count of violating 18 U.S.C. § 1030 in Federal 
Court, and to four state felony counts. As part of his guilty plea, Smith stipulated 
to affecting one million computer systems and causing $80 million in damage. Smith 
is awaiting sentencing. 

Criminal Groups. We are also seeing the increased use of cyber intrusions by 
criminal groups who attack systems for purposes of monetary gain. In September, 
1999, two members of a group dubbed the “Phonemasters” were sentenced after 
their conviction for theft and possession of unauthorized access devices (18 USC 
§ 1029) and unauthorized access to a Federal interest computer (18 USC § 1030). 
The “Phonemasters” were an international group of criminals who penetrated the 
computer systems of MCI, Sprint, AT&T, Equifax, and even the National Crime In- 
formation Center. Under judicially approved electronic surveillance orders, the FBI’s 
Dallas Division made use of new data intercept technology to monitor the calling 
activity and modem pulses of one of the suspects, Calvin Cantrell. Mr. Cantrell 
downloaded thousands of Sprint calling card numbers, which he sold to a Canadian 
individual, who passed them on to someone in Ohio. These numbers made their way 
to an individual in Switzerland and eventually ended up in the hands of organized 
crime groups in Italy. Cantrell was sentenced to two years as a result of his guilty 
plea, while one of his associates, Cory Lindsay, was sentenced to 41 months. 

The Phonemasters’ methods included “dumpster diving” to gather old phone books 
and technical manuals for systems. They used this information to trick employees 
into giving up their logon and password information. The group then used this infor- 
mation to break into victim systems. It is important to remember that often 
“cybercrimes” are facilitated by old fashioned guile, such as calling employees and 
tricking them into giving up passwords. Good cyber security practices must there- 
fore address personnel security and “social engineering” in addition to instituting 
electronic security measures. 
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Another example of cyber intrusions used to implement a criminal conspiracy in- 
volved Vladimir L. Levin and numerous accomplices who illegally transferred more 
than $10 million in funds from three Citibank corporate customers to bank accounts 
in California, Finland, Germany, the Netherlands, Switzerland, and Israel between 
June and October 1994. Levin, a Russian computer expert, gained access over 40 
times to Citibank’s cash management system using a personal computer and stolen 
passwords and identification numbers. Russian telephone company employees work- 
ing with Citibank were able to trace the source of the transfers to Levin’s employer 
in St. Petersburg, Russia. Levin was arrested in March 1995 in London and subse- 
quently extradited to the U.S. On February 24, 1998, he was sentenced to three 
years in prison and ordered to pay Citibank $240,000 in restitution. Four of Levin’s 
accomplices pleaded guilty and one was arrested but could not be extradited. 
Citibank was able to recover all but $400,000 of the $10 million illegally transferred 
funds. 

Unfortunately, cyberspace provides new tools not only for criminals, but for na- 
tional security threats as well. These include terrorists, foreign intelligence agen- 
cies, and foreign militaries. Director of Central Intelligence George Tenet testified 
in February 2000, before the Senate Armed Services Committee, that many of the 
tools and weapons that can be used for information warfare purposes are “available 
on the open market at relatively little cost.” The DCI went on to note that the crit- 
ical threat of IW lies in its potential as a “force multiplier” for an adversary of the 
United States. 

Three major categories of threat actors pose a national security challenge to the 
United States in cyberspace. 

Terrorists. Terrorists groups are increasingly using new information technology 
and the Internet to formulate plans, raise funds, spread propaganda, and to commu- 
nicate securely. In his statement on the worldwide threat in 2000, Director of Cen- 
tral Intelligence George Tenet testified that terrorists groups, “including Hizbollah, 
HAMAS, the Abu Nidal organization, and Bin Laden’s al Qaeda organization are 
using computerized files, e-mail, and encryption to support their operations.” In one 
example, convicted terrorist Ramzi Yousef, the mastermind of the World Trade Cen- 
ter bombing, stored detailed plans to destroy United States airliners on encrypted 
files on his laptop computer. While we have not yet seen these groups employ cyber 
tools as a weapon to use against critical infrastructures, their reliance on informa- 
tion technology and acquisition of computer expertise are clear warning signs. More- 
over, we have seen other terrorist groups, such as the Internet Black Tigers (who 
are reportedly affiliated with the Tamil Tigers), engage in attacks on foreign Gov- 
ernment web-sites and email servers. “Cyber terrorism” — by which I mean the use 
of cyber tools to shut down critical national infrastructures (such as energy, trans- 
portation, or Government operations) for the purpose of coercing or intimidating a 
Government or civilian population — is thus a very real, though still largely poten- 
tial, threat. 

Foreign intelligence services. Not surprisingly, foreign intelligence services have 
adapted to using cyber tools as part of their espionage tradecraft. Even as far back 
as 1986, before the worldwide surge in Internet use, the KGB employed West Ger- 
man hackers to access Department of Defense systems in the well-known “Cuckoo’s 
Egg” case. While I cannot go into specifics about more recent developments in an 
open hearing, it should not surprise anyone to hear that foreign intelligence services 
increasingly view computer intrusions as a useful tool for acquiring sensitive U.S. 
Government and private sector information. 

Information Warfare. The prospect of “information warfare” by foreign militaries 
against our critical infrastructures is perhaps the greatest potential cyber threat to 
our national security. We know that several foreign nations are developing informa- 
tion warfare doctrine, programs, and capabilities for use against the United States 
or other nations. Knowing that they cannot match our military might with conven- 
tional or “kinetic” weapons, nations see cyber attacks on our critical infrastructures 
or military operations as a way to hit what they perceive as America’s Achilles 
heel — our growing dependence on information technology in Government and com- 
mercial operations. For example, two Chinese military officers recently published a 
book that called for the use of unconventional measures, including the propagation 
of computer viruses, to counterbalance the military power of the United States. And 
a Russian official has also commented that an attack on a critical infrastructure 
could, “by virtue of its catastrophic consequences, completely overlap with the use 
of [weapons] of mass destruction.” 
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Distributed Denial of Service Tools 

The recent distributed denial of service (DDOS) attacks on e-commerce sites have 
garnered a tremendous amount of interest in the public and in the Congress. While 
we do not yet have official damage estimates, the Yankee Group, a research firm, 
estimates the impact of the attacks at $1.2 billion due to lost capitalization losses, 
lost revenues, and security upgrades. Because we are actively investigating these at- 
tacks, I cannot provide a detailed briefing on the status of our efforts. However, I 
can provide an overview of our activities to deal with the DDOS threat beginning 
last year and of our investigative efforts over the last three weeks. These attacks 
illustrate the growing availability of destructive, yet easy-to-use, exploits that are 
widely available on the Internet. They also demonstrate the NIPC’s two-fold mis- 
sion: sharing information with the private sector and warning of possible threats, 
and responding to actual attacks. 

In the fall of last year, the NIPC began receiving reports about a new set of “ex- 
ploits” or attack tools collectively called distributed denial of service (or DDOS) 
tools. DDOS variants include tools known as “TrinOO,” “Tribal Flood Net” (TFN), 
“TFN2K,” and “Stacheldraht” (German for “barbed wire”). These tools essentially 
work as follows: hackers gain unauthorized access to a computer system(s) and 
place software code on it that renders that system a “master” (or a “handler”). The 
hackers also intrude into other networks and place malicious code which makes 
those systems into agents (also known as “zombies” or “daemons” or “slaves”). Each 
Master is capable of controlling multiple agents. In both cases, the network owners 
normally are not aware that dangerous tools have been placed and reside on their 
systems, thus becoming third-party victims to the intended crime. 

The “Masters” are activated either remotely or by internal programming (such as 
a command to begin an attack at a prescribed time) and are used to send informa- 
tion to the agents, activating their DDOS ability. The agents then generate numer- 
ous requests to connect with the attack’s ultimate target! s), typically using a ficti- 
tious or “spoofed” IP (Internet Protocol) address, thus providing a falsified identity 
as to the source of the request. The agents act in unison to generate a high volume 
of traffic from several sources. This type of attack is referred to as a SYN flood, as 
the SYN is the initial effort by the sending computer to make a connection with the 
destination computer. Due to the volume of SYN requests the destination computer 
becomes overwhelmed in its efforts to acknowledge and complete a transaction with 
the sending computers, degrading or denying its ability to complete service with le- 
gitimate customers — hence the term “Denial of Service”. These attacks are espe- 
cially damaging when they are coordinated from multiple sites — hence the term Dis- 
tributed Denial of Service. 

An analogy would be if someone launched an automated program to have hun- 
dreds of phone calls placed to the Capitol switchboard at the same time. All of the 
good efforts of the staff would be overcome. Many callers would receive busy signals 
due to the high volume of telephone traffic. 

In November and December, the NIPC received reports that universities and oth- 
ers were detecting the presence of hundreds of agents on their networks. The num- 
ber of agents detected clearly could have been only a small subset of the total num- 
ber of agents actually deployed. In addition, we were concerned that some malicious 
actors might choose to launch a DDOS attack around New Year’s Eve in order to 
cause disruption and gain notoriety due to the great deal of attention that was being 
payed to the Y2K rollover. Accordingly, we decided to issue a series of alerts in De- 
cember to Government agencies, industry, and the public about the DDOS threat. 

Moreover, in late December, we determined that a detection tool that we had de- 
veloped for investigative purposes might also be used by network operators to detect 
the presence of DDOS agents or masters on their operating systems, and thus would 
enable them to remove an agent or master and prevent the network from being un- 
wittingly utilized in a DDOS attack. Moreover, at that time there was, to our knowl- 
edge, no similar detection tool available commercially. We therefore decided to take 
the unusual step of releasing the tool to the Department of Defense, other Govern- 
ment agencies, and to the public in an effort to reduce the level of the threat. We 
made the first variant of our software available on the NIPC web site on December 
30, 1999. To maximize the public awareness of this tool, we announced its avail- 
ability in an FBI press release that same date. Since the first posting of the tool, 
we have posted three updated versions that have perfected the software and made 
it applicable to different operating systems. 

The public has downloaded these tools tens of thousands of times from the web 
site, and has responded by reporting many installations of the DDOS software, 
thereby preventing their networks from being used in attacks and leading to the 
opening of criminal investigations both before and after the widely publicized at- 
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tacks of the last few weeks. Our work with private companies has been so well re- 
ceived that the trade group SANS awarded their yearly Security Technology Leader- 
ship Award to members of the NIPC’s Special Technologies Applications Unit. 

Last month, we received reports that a new variation of DDOS tools was being 
found on Windows operating systems. One victim entity provided us with the object 
code to the tool found on its network. On February 18 we made the binaries avail- 
able to anti-virus companies (through an industry association) and the Computer 
Emergency Response Team (CERT) at Carnegie Mellon University for analysis and 
so that commercial vendors could create or adjust their products to detect the new 
DDOS variant. Given the attention that DDOS tools have received in recent weeks, 
there are now numerous detection and security products to address this threat, so 
we determined that we could be most helpful by giving them the necessary code 
rather than deploying a detection tool ourselves. 

Unfortunately, the warnings that we and others in the security community had 
issued about DDOS tools last year, while alerting many potential victims and reduc- 
ing the threat, did not eliminate the threat. Quite frequently, even when a threat 
is known and patches or detection tools are available, network operators either re- 
main unaware of the problem or fail to take necessary protective steps. In addition, 
in the cyber equivalent of an arms race, exploits evolve as hackers design variations 
to evade or overcome detection software and filters. Even security-conscious compa- 
nies that put in place all available security measures therefore are not invulnerable. 
And, particularly with DDOS tools, one organization might be the victim of a suc- 
cessful attack despite its best efforts, because another organization failed to take 
steps to keep itself from being made tbe unwitting participant in an attack. 

On February 7, 2000, the NIPC received reports that Yahoo had experienced a 
denial of service attack. In a display of the close cooperative relationship that we 
have developed with the private sector, in the days that followed, several other com- 
panies (including Cable News Network, eBay, Amazon.com, Buy.com, and ZDNET), 
also reported denial of service outages to the NIPC or FBI field offices. These com- 
panies cooperated with us by providing critical logs and other information. Still, the 
challenges to apprehending the suspects are substantial. In many cases, the 
attackers used “spoofed” IP addresses, meaning that the address that appeared on 
the target’s log was not the true address of the system that sent the messages. In 
addition, many victims do not keep complete network logs. 

The resources required in an investigation of this type are substantial. Companies 
have been victimized or used as “hop sites” in numerous places across the country, 
meaning that we must deploy special agents nationwide to work leads. We currently 
have seven FBI field offices with cases opened and all the remaining offices are sup- 
porting the offices that have opened cases. Agents from these offices are following 
up literally hundreds of leads. The NIPC is coordinating the nationwide investiga- 
tive effort, performing technical analysis of logs from victims sites and Internet 
Service Providers (ISPs), and providing all-source analytical assistance to field of- 
fices. Moreover, parts of the evidentiary trail have led overseas, requiring us to 
work with our foreign counterparts in several countries through our Legal Attaches 
(Legats) in U.S. embassies. 

While the crime may be high tech, investigating it involves a substantial amount 
of traditional investigative work as well as highly technical work. Interviews of net- 
work operators and confidential sources can provide very useful information, which 
leads to still more interviews and leads to follow-up. And victim sites and ISPs pro- 
vide an enormous amount of log information that needs to be processed and ana- 
lyzed by human analysts. 

Despite these challenges, I am optimistic that the hard work of our agents, ana- 
lysts, and computer scientists; the excellent cooperation and collaboration we have 
with private industry and universities; and the teamwork we are engaged in with 
foreign partners will in the end prove successful. 

Interagency Cooperation 

The broad spectrum of cyber threats described earlier, ranging from hacking to 
foreign espionage and information warfare, requires not just new technologies and 
skills on the part of investigators, but new organizational constructs as well. In 
most cyber attacks, the identity, location, and objective of the perpetrator are not 
immediately apparent. Nor is the scope of his attack — i.e., whether an intrusion is 
isolated or part of a broader pattern affecting numerous targets. This means it is 
often impossible to determine at the outset if an intrusion is an act of cyber van- 
dalism, organized crime, domestic or foreign terrorism, economic or traditional espi- 
onage, or some form of strategic military attack. The only way to determine the 
source, nature, and scope of the incident is to gather information from the victim 
sites and intermediate sites such as ISPs and telecommunications carriers. Under 
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our constitutional system, such information typically can be gathered only pursuant 
to criminal investigative authorities. This is why the NIPC is part of the FBI, allow- 
ing us to utilize the FBI’s legal authorities to gather and retain information and to 
act on it, consistent with constitutional and statutory requirements. 

But the dimension and varied nature of the threats also means that this is an 
issue that concerns not just the FBI and law enforcement agencies, but also the De- 
partment of Defense, the Intelligence Community, and civilian agencies with infra- 
structure-focused responsibility such as the Departments of Energy and Transpor- 
tation. It also is a matter that greatly affects state and local law enforcement. This 
is why the NIPC is an interagency center, with representatives detailed to the FBI 
from numerous Federal agencies and representation from state and local law en- 
forcement as well. These representatives operate under the direction and authority 
of the FBI, but bring with them expertise and skills from their respective home 
agencies that enable better coordination and cooperation among all relevant agen- 
cies, consistent with applicable laws. 

We have had many instances in the last two years where this interagency co- 
operation has proven critical. As mentioned earlier, the case of the Melissa virus 
was successfully resolved with the first successful Federal prosecution of a virus 
propagator in over a decade because of close teamwork between the NIPCI squad 
in the FBI’s Newark Division and other field offices, the New Jersey State Police, 
and the NIPC. 

The “Solar Sunrise” case is another example of close teamwork with other agen- 
cies. In 1998, computer intrusions into U.S. military computer systems occurred 
during the Iraq weapons inspection crisis. Hackers exploited known vulnerabilities 
in Sun Solaris operating systems. Some of the intrusions appeared to be coming 
from the Middle East. The timing, nature, and apparent source of some of the at- 
tacks raised concerns in the Pentagon that this could be a concerted effort by Iraq 
to interfere with U.S. troop deployments. NIPC coordinated a multi-agency inves- 
tigation which included the FBI, the Air Force Office of Special Investigations, the 
National Aeronautics and Space Administration, the Department of Justice, the De- 
fense Information Systems Agency, the National Security Agency, and the Central 
Intelligence Agency. Within several days, the investigation determined that the in- 
trusions were not the work of Iraq, but of several teenagers in the U.S. and Israel. 
Two juveniles in California pleaded guilty to the intrusions, and several Israelis still 
await trial. The leader of the Israeli group, Ehud Tenenbaum, has been indicted and 
is currently scheduled for trial in Israel in April. 

More recently, we observed a series of intrusions into numerous Department of 
Defense and other Federal Government computer networks and private sector enti- 
ties. Investigation last year determined that the intrusions appear to have origi- 
nated in Russia. The intruder successfully accessed U.S. Government networks and 
took large amounts of unclassified but sensitive information, including defense tech- 
nical research information. The NIPC coordinated a multi-agency investigation, 
working closely with FBI field offices, the Department of Defense, and the Intel- 
ligence Community. While I cannot go into more detail about this case here, it dem- 
onstrates the very real threat we face in the cyber realm, and the need for good 
teamwork and coordination among Government agencies responsible for responding 
to the threat. 

Private Sector Cooperation 

Our success in battling cybercrime also depends on close cooperation with private 
industry. This is the case for several reasons. First, most of the victims of 
cybercrimes are private companies. Therefore, successful investigation and prosecu- 
tion of cybercrimes depends on private victims reporting incidents to law enforce- 
ment and cooperating with the investigators. Contrary to press statements by cyber 
security companies that private companies won’t share information with law en- 
forcement, many private companies have reported incidents and threats to the NIPC 
or FBI field offices. The number of victims who have voluntarily reported DDOS at- 
tacks to us over the last few weeks is ample proof of this. While there are undoubt- 
edly companies that would prefer not to report a crime because of fear of public em- 
barrassment over a security lapse, the situation has improved markedly. Companies 
increasingly realize that deterrence of crime depends on effective law enforcement, 
and that the long-term interests of industry depend on establishing a good working 
relationship with Government to prevent and investigate crime. 

Testimony two weeks ago before the Senate Appropriations Subcommittee for 
Commerce, State, and Justice by Robert Chesnut, Associate General Counsel for 
eBay, illustrates this point: 
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Prior to last week’s attacks, eBay had established a close working relationship 
with the computer crimes squad within the Northern California office of the 
Federal Bureau of Investigation (“FBI”). eBay has long recognized that the best 
way to combat cybercrime, whether it’s fraud or hacking, is by working coopera- 
tively with law enforcement. Therefore, last year we established procedures for 
notifying the FBI in the event of such an attack on our web site. As result of 
this preparation, we were able to contact the FBI computer intrusion squad dur- 
ing the attack and provide them with information that we expect will assist in 
their investigation. In the aftermath of the attack, eBay has also been able to 
provide the FBI with additional leads that have come to our attention. 

Second, the network administrator at a victim company or ISP is critical to the 
success of an investigation. Only that administrator knows the unique configuration 
of her system, and she typically must work with an investigator to find critical 
transactional data that will yield evidence of a criminal’s activity. 

Third, the private sector has the technical expertise that is often critical to resolv- 
ing an investigation. It would be impossible for us to retain experts in every possible 
operating system or network configuration, so private sector assistance is critical. 
In addition, many investigations require the development of unique technical tools 
to deal with novel problems. Private sector assistance has been critical there as 
well. 

We have several other initiatives devoted to private sector outreach that bear 
mentioning here. The first is called “InfraGard.” This is an initiative that we have 
developed in concert with private companies and academia to encourage informa- 
tion-sharing about cyber intrusions, exploited vulnerabilities, and physical infra- 
structure threats. A vital component of InfraGard is the ability of industry to pro- 
vide information on intrusions to the local FBI field office using secure e-mail com- 
munications in both a “sanitized” and detailed format. The local FBI field offices 
can, if appropriate, use the detailed version to initiate an investigation; while NIPC 
Headquarters can analyze that information in conjunction with other information 
we obtain to determine if the intrusion is part of a broader attack on numerous 
sites. The NIPC can simultaneously use the sanitized version to inform other mem- 
bers of the intrusion without compromising the confidentiality of the reporting com- 
pany. The key to this system is that whether, and what, to report is entirely up 
to the reporting company. A secure web site also contains a variety of analytic and 
warning products that we make available to the InfraGard community. The success 
of InfraGard is premised on the notion that sharing is a two-way street: the NIPC 
will provide threat information that companies can use to protect their systems, 
while companies will provide incident information that can be used to initiate an 
investigation and to warn other companies. 

Our Key Asset Initiative (KAI) is focused more specifically on the owners and op- 
erators of critical components of each of the infrastructure sectors. It facilitates re- 
sponse to threats and incidents by building liaison and communication links with 
the owners and operators of individual companies and enabling contingency plan- 
ning. The KAI began in the 1980s and focused on physical vulnerabilities to ter- 
rorism. Under the NIPC, the KAI has been reinvigorated and expanded to focus on 
cyber vulnerabilities as well. The KAI currently involves determining which assets 
are key within the jurisdiction of each FBI Field Office and obtaining 24-hour points 
of contact at each asset in cases of emergency. Eventually, if future resources per- 
mit, the initiative will include the development of contingency plans to respond to 
attacks on each asset, exercises to test response plans, and modeling to determine 
the effects of an attack on particular assets. FBI field offices are responsible for de- 
veloping a list of the assets within their respective jurisdictions, while the NIPC 
maintains the national database. The KAI is being developed in coordination with 
DOD and other agencies. Currently the database has about 2600 entries. This rep- 
resents 2600 contacts with key private sector nodes made by the NIPC and FBI field 
offices. 

A third initiative is a pilot program we have begun with the North American Elec- 
trical Reliability Council (NERC). Under the pilot program, electric utility compa- 
nies and other power entities transmit cyber incident reports in near real time to 
the NIPC. These reports are analyzed and assessed to determine whether an NIPC 
warning, alert, or advisory is warranted. Electric power participants in the pilot pro- 
gram have stated that the information and analysis provided by the NIPC back to 
the power companies fully justify their participation in the program. It is our expec- 
tation that the Electrical Power Indications and Warning System will provide a full- 
fledged model for the other critical infrastructures. 

Much has been said over the last few years about the importance of information 
sharing. Since our founding, the NIPC has been actively engaged in building con- 
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Crete mechanisms and initiatives to make this sharing a reality, and we have built 
up a track record of actually sharing useful information. These efforts belie the no- 
tions that private industry won’t share with law enforcement in this area, or that 
the Government won’t provide meaningful threat data to industry. As companies 
continue to gain experience in dealing with the NIPC and FBI field offices, as we 
continue to provide them with important and useful threat information, and as com- 
panies recognize that cybercrime requires a joint effort by industry and Government 
together, we will continue to make real progress in this area. 

Meeting the Growing Cyber Threat 

As Internet use continues to soar, the number of cyber attacks is also increasing 
exponentially. Our case load reflects this growth. In FY 1998, we opened 547 com- 
puter intrusion cases; in FY 1999, that number jumped to 1154. Similarly, the num- 
ber of pending cases increased from 206 at the end of FY 1997, to 601 at the end 
of FY 1998, to 834 at the end of FY 99, and to over 900 currently. These statistics 
include only computer intrusion cases, and do not account for computer facilitated 
crimes such as Internet fraud, child pornography, or e-mail extortion efforts. In 
these cases, the NIPC and NIPCI squads often provide technical assistance to tradi- 
tional investigative programs responsible for these categories of crime. 

We can clearly expect these upward trends to continue, and for the threats to be- 
come more serious. While insiders, hackers, and criminal groups make up much of 
our case load at the moment, we can anticipate a growing number of national secu- 
rity cases in the near future. To meet this challenge, we must ensure that we have 
adequate resources, including both personnel and equipment, both at the NIPC and 
in FBI field offices. We currently have 193 agents nationwide dedicated to inves- 
tigating computer intrusion and virus cases. In order to maximize investigative re- 
sources the FBI has taken the approach of creating regional squads in 16 field of- 
fices that have sufficient size to work complex intrusion cases and to assist those 
field offices without a NIPCI squad. In those field offices without squads, the FBI 
is building a baseline capability by having one or two agents to work NIPC matters, 
i.e. computer intrusions (criminal and national security), viruses, InfraGard, state 
and local liaison, etc. 

At the NIPC, we currently have 101 personnel on board, including 82 FBI employ- 
ees and 19 detailees from other Government agencies. This cadre of investigators, 
computer scientists, and analysts perform the numerous and complex tasks outlined 
above, and provide critical coordination and support to field office investigations. As 
the crime problem grows, we need to make sure that we keep pace by bringing on 
board additional personnel, including from other agencies and the private sector. 

In addition to putting in place the requisite number of agents, analysts, and com- 
puter scientists in the NIPC and in FBI field offices, we must fill those positions 
by recruiting and retaining personnel who have the appropriate technical, analyt- 
ical, and investigative skills. This includes personnel who can read and analyze com- 
plex log files, perform all-source analysis to look for correlations between events or 
attack signatures and glean indications of a threat, develop technical tools to ad- 
dress the constantly changing technological environment, and conduct complex net- 
work investigations. There is a very tight market for information technology profes- 
sionals. The Federal Government needs to be able to recruit the very best people 
into its programs. Fortunately, we can offer exciting, cutting-edge work in this area 
and can offer agents, analysts, and computer scientists the opportunities to work on 
issues that no one else addresses, and to make a difference to our national security 
and public safety. In addition, Congress provided the FBI with a pilot program that 
exempts certain technical personnel from the Title V civil service rules, which al- 
lows us to pay more competitive salaries and recruit and retain top notch personnel. 
Unfortunately, this pilot is scheduled to expire in November unless extended. 

Training and continuing education are also critical, and we have made this a top 
priority at the NIPC. In FY 1999, we trained 383 FBI and other-Government-agency 
students in NIPC sponsored training classes on network investigations and infra- 
structure protection. The emphasis for 2000 is on continuing to train Federal per- 
sonnel while expanding training opportunities for state and local law enforcement 
personnel. During FY 2000, we plan to train approximately 740 personnel from the 
FBI, other Federal agencies, and state and local law enforcement. 

Developing and deploying the best equipment in support of the mission is also 
very important. Not only do investigators and analysts need the best equipment to 
conduct investigations in the rapidly evolving cyber system but the NIPC must be 
on the cutting edge of cyber research and development. Conducting a network intru- 
sion or denial-of-service investigation often requires analysis of voluminous amounts 
of data. For example, one network intrusion case involving an espionage matter cur- 
rently being investigated has required the analysis of 17.5 Terabytes of data. To 
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place this into perspective, the entire collection of the Library of Congress, if 
digitized, would comprise only 10 Terabytes. The Yahoo DDOS attack involved ap- 
proximately 630 Gigabytes of data, which is equivalent to enough printed pages to 
fill 630 pickup trucks with paper. Technical analysis requires high capacity equip- 
ment to store, process, analyze, and display data. Again, as the crime problem 
grows, we must ensure that our technical capacity keeps pace. We are also working 
closely with other agencies to ensure that we leverage existing resources to the full- 
est extent possible. 

Challenges in Combating Cyber Intrusions 

The burgeoning problem of cyber intrusions, viruses, and denial of service attacks 
poses unique challenges to the NIPC. These challenges require novel solutions, close 
teamwork among agencies and with the private sector, and adequate human and 
technical resources. 

Identifying the Intruder. One major difficulty that distinguishes cyber threats 
from physical threats is determining who is attacking your system, why, how, and 
from where. This difficulty stems from the ease with which individuals can hide or 
disguise their tracks by manipulating logs and directing their attacks through net- 
works in many countries before hitting their ultimate target. The “Solar Sunrise” 
case illustrates this point. This will continue to pose a problem as long as the Inter- 
net remains rife with vulnerabilities and allows easy anonymity and concealment. 

Jurisdictional Issues. Another significant challenge we face is intrusions involving 
multiple jurisdictions. A typical investigation involves victim sites in multiple states 
and often many countries. This is the case even when the hacker and victim are 
both located in the United States. In the United States, we can subpoena records, 
engage in judicially approved electronic surveillance, and execute search warrants 
on suspects’ homes, seize evidence, and examine it. We can do none of those things 
ourselves overseas; rather, we depend on the local authorities to assist us. In some 
cases the local police forces simply do not understand or cannot cope with the tech- 
nology. In other cases, these nations simply do not have laws against computer in- 
trusions and are therefore limited in their ability to help us. FBI Legal Attaches 
in 35 embassies abroad provide critical help in building bridges with local law en- 
forcement to enhance cooperation on cybercrime and in working leads on investiga- 
tions. As the Internet spreads to even more countries, we will see greater demands 
placed on the Legats to support computer crime investigations. The NIPC also has 
held international computer crime conferences and offered cybercrime training class- 
es to foreign law enforcement officials to develop liaison contacts and bring these 
officials up to speed on cybercrime issues. 

The most difficult situation will arise, however, in which a foreign country with 
interests adverse to our own simply refuses to cooperate. In such a situation, we 
could find that an investigation is stymied unless we find an alternative method of 
tracing the activity back to its source. 

The Role of Law Enforcement 

Finally, I would like to conclude by emphasizing two key points. The first is that 
our role in combating cybercrime is essentially two-fold: (1) preventing cyber attacks 
before they occur or limiting their scope by disseminating warnings and advisories 
about threats so that potential victims can protect themselves; and (2) responding 
to attacks that do occur by investigating and identifying the perpetrator. This is 
very much an operational role. Our role is not to determine what security measures 
private industry should take, or to ensure that companies or individuals take them. 
It is the responsibility of industry to ensure that appropriate security tools are made 
available and are implemented. We certainly can assist industry by alerting them 
to the actual threats that they need to be concerned about, and by providing infor- 
mation about the exploits that we are seeing criminals use. But network administra- 
tors, whether in the private sector or in Government, are the first line of defense. 

Second, in gathering information as part of our warning and response missions, 
we rigorously adhere to constitutional and statutory requirements. Our conduct is 
strictly limited by the Fourth Amendment, statutes such as Title III and ECPA, and 
the Attorney General Guidelines. These rules are founded first and foremost on the 
protection of privacy inherent in our constitutional system. Respect for privacy is 
thus a fundamental guidepost in all of our activities. 
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Conclusion 

I want to thank the Subcommittee again for giving me the opportunity to testify 
here today. The cyber threat is real, multifarious, and growing. The NIPC is moving 
aggressively to meet this challenge by training investigators and analysts to inves- 
tigate computer intrusion cases, equipping them with the latest technology, devel- 
oping our analytic capabilities and warning mechanisms to head off or mitigate at- 
tacks, and closely cooperating with the private sector. We have already made consid- 
erable progress in developing our capabilities to protect public safety and national 
security in the Information Age. I look forward to working with Congress to ensure 
that we continue to be able to meet the threat as it evolves and grows. Thank you. 

Senator Burns. Thank you very much, Mr. Vatis. 

We have been joined by Senator Wyden. Do you have a state- 
ment, Senator? 

Senator Wyden. Thank you, Senator. I will just wait for ques- 
tions. 

Senator Burns. Thank you. 

I want to preface my line of thinking here just a little bit. We 
have an economic thing that is happening right now in the Amer- 
ican business world, and in fact our whole economics, and we have 
this terrific increase in energy prices, which is going to create a lit- 
tle more pressure, I think, on the Internet, the way we move infor- 
mation, the way we do business, because of the cost of transpor- 
tation to be right honest with you. 

I think before the summer is out you are going to see we are 
going to be in a crisis situation. I cannot imagine right now my 
farmers, and this is a long way from what we are talking about, 
but I cannot imagine doubling the cost of fuel and trying to sell a 
product off the farm now that is not making any money under the 
conditions of last year, and now we are going to double our input 
cost and expect the same price this year. 

I cannot imagine me even cranking the first flywheel on a trac- 
tor, to be right honest with you, but we have that moving, and I 
have a feeling this is going not only in the way we move informa- 
tion but also our e-commerce is going to have new pressures, as far 
as volume is concerned, in the upcoming year as we face this en- 
ergy situation for the rest of the year, so I want to preface that, 
and that is what I am kind of concerned about. 

Then we talk about security. Mr. Holder, with the exception to 
formal hearings, have you been in any communications with any of 
the Members of Congress regarding this situation to describe to 
them what your concerns are and the needs we are going to have? 

Now, the representative from the Federal Bureau of Investiga- 
tion says it is going to take a lot of teamwork between industry, 
Government, between Government agencies within the Govern- 
ment, and I am saying that I do not think I have had one call from 
one agency saying we have got a phenomenon out here that is 
working and some way or another we are going to have to deal 
with this. 

And Congress I think will play a role and has to play a role in 
the future, but have you had any kind of meetings with Congress 
to bring us, Senator Hollings or whoever, up to date on the role 
that we should be playing, and especially your concerns about secu- 
rity and these kinds of situations? 

Mr. Holder. To my knowledge there has been work, I think, at 
the staff level. I have not convened any meetings with any Mem- 
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bers of Congress, but I think we have had meetings at the staff 
level to talk about the needs we have identified both with regard 
to legislation and resources. 

The Attorney General has talked about the creation of a 5-year 
plan starting in the next fiscal year to figure out exactly what chal- 
lenges we think we are going to face, what resources we think we 
are going to need to face those challenges, and we think in that re- 
gard, in the formulation of that plan in particular, that interaction 
with Congress on the Senate side and the House side would be par- 
ticularly important. 

Senator Burns. I say that because sometimes in these situations 
we are kind of behind the curve, even though you may have some 
facts that maybe we can prevent — and I am not saying that we 
have got the answers, but I am saying, though, that Congress fi- 
nally has to play a role somewhere along the line in consultation 
between the agencies and Congress. 

It would certainly help us, some of us — and even on the security 
side, can you give me, any of you can give me a profile of what kind 
of personalities engage in these destructive and senseless attacks 
like we have experienced? 

Mr. Vatis. I am actually reluctant to state any one profile be- 
cause there is a tremendous range of different types of actors that 
we see, ranging from the insider, an employee or a former em- 
ployee at a company who wants to take revenge against his em- 
ployer and so steals information to give to a competitor, or shuts 
down the system just to spite his employer. Teenage hackers who 
are breaking into systems just for bragging rights in the hacker 
community, or for the challenge of doing it. 

More and more, organized groups of often young people but not 
necessarily juveniles who are breaking into systems to steal things 
for financial gain, and then all the way on the other end of the 
spectrum, foreign intelligence services that we are seeing looking 
at these new tools as a new mechanism for gathering information, 
so it really runs the gamut across that broad range. 

Senator Burns. Senator Hollings. 

Senator Hollings. I am encouraged by the appearance of each 
of you, and particularly Mr. Vatis, that the FBI is on top of it. We 
have had the Appropriations Committee hearings on this, and topic 
currently, under Senator Gregg’s leadership we have been getting 
into child pornography and other internet-related issues. 

The grasp of these subjects is necessary, but I would dissent from 
the idea expressed, and the timidity, about how the private sector 
should do this. Look here, if the private sector could do it they 
would find money in it and do it. 

We got into the Internet to secure our communications. We said 
back in the late sixties, suppose they drop a bomb on the Pentagon 
and we have got all the troops out there — divisions and tanks and 
planes — but nobody can communicate. So then we started tying to- 
gether research endeavors on the various university campuses, and 
ergo, the Internet. Now it is our responsibility of the infrastructure 
to get the security. 

I have got to go, Mr. Chairman, right down to the conference on 
the FAA authorization bill. Before I go, let me note that we have 
to make sure that our transportation systems line air transpor- 
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tation are secure. You would not want somebody to muck up the 
radar and everything else at Reagan National and suddenly have 
the planes start crashing all around. None of us wants to go to an 
interview and say, “well, you know, we just had a hearing on it, 
and we all agreed it is the private sector’s responsibility. Let the 
planes crash.” I mean, come on. 

Let’s get away from this argument that security is a private sec- 
tor responsibility. After all this industry is developing pell-mell into 
oligopolies where two or three more or less control the market and 
whereby no one else can get in. 

We find Microsoft, for example, buying up some 200 different in- 
dividual little endeavors, anytime anybody comes in with a new 
idea, the oligopoly comes in and says, whoopee, we will pay you so 
much or we will extinguish it. So you take the money, and that 
ends that. 

The Government has a fundamental role in the Internet. Let’s 
stop waiting on the partnerships and let’s face our responsibility to 
secure our own infrastructure. We need to protect our own depart- 
ments, communications, power, transportation, and otherwise. Can 
we do it? Is it possible? Who can answer that? Can we really make 
it secure, do you think? 

Mr. Vatis. I will just briefly address that. I think we absolutely 
can. I think the technology exists, and is being developed, to secure 
our systems. I think there has been a rush to market with new fea- 
tures for competitive reasons, and security has lagged behind as a 
concern of the manufacturers. 

Senator Hollings. What you are telling me, and you can inter- 
rupt me, is if I can make it secure, then I can certainly guarantee 
the privacy, because I can make certain that that security is not 
invaded, is that right, and logical? 

Mr. Vatis. I think the means exist to protect privacy, to protect 
the operability of systems, and I think we are seeing some signifi- 
cant strides in that direction. 

I think I agree with you that the Federal Government does have 
primary responsibility, certainly for securing its own systems, and 
certainly for carrying out law enforcement responsibilities, which is 
a fundamental task of Government, and for issuing warnings about 
attacks. 

But the one place I think that the private sector does have the 
primary responsibility is for ensuring its own security. If a busi- 
ness goes into e-commerce and puts out a Web site through which 
it transacts business with customers, it cannot be our responsibility 
in the Government to tell them how to secure that system, or to 
regulate how they do that. That is what I mean by security being 
primarily the private sector’s responsibility. 

Senator Hollings. At DARPA, we gave all our research tech- 
nology over to Boeing and Lockheed, and they are going like 
gangbusters. There is a similar situation at the National Institute 
of Standards and Technology. We farm out all of that technology. 
We are not trying to hold it, but we are trying to find it. 

It is very interesting, Mr. Chairman, because your bill got this 
gentleman, Mr. Reinsch — it is interesting that he is from the Ex- 
port Administration. He is not from any security — he is not from 
any technology. He is from exports, and here he appears from the 
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Export Administration. Now, correct me, and tell me about your 
technology. 

Mr. Reinsch. What my bureau does, Senator Hollings, is control 
the export of critical technology products for national security rea- 
sons. 

Senator Hollings. That is how you got in it, and that is the only 
reason that we woke up here, at the congressional level, because 
of the export of the technology. It was not because of the import, 
the use, the development, the securing, or the infrastructure of the 
U.S. Government. 

Mr. Reinsch. Well, if I could comment on several of your points, 
that part I think has proven to be an area of much broader agree- 
ment, and typically in a debate environment, there is less attention 
paid to it. If you will look at the plan, you will find most of it and 
most of the Government’s resources right now, in fact, are devoted 
to precisely what you are talking about, which is the protection of 
Federal Government critical systems and assets. 

Senator Hollings. Is there any need otherwise in what you have 
outlined? I like the President’s plan, but you know from experience 
you have got all the resources. You are heading it up. Do you need 
any help, and do we need to pass any law or fund any policy that 
you can think of? 

Mr. Reinsch. Let me say tactfully, Senator Hollings, that the 
Appropriations Committees have been very generous to law en- 
forcement and national security, and less generous to the Com- 
merce Department and civilian agencies that have some of these 
same responsibilities. 

Senator Hollings. How much more do you need at the Com- 
merce Department? 

Mr. Reinsch. Well, we support the President’s request, for 2001. 

Senator Hollings. How about your request? What else would 
you like to have? 

Mr. Reinsch. For my particular bureau? You do not want me to 
start on that. 

[Laughter.] 

Senator Hollings. In all fairness, tell us what you need to do 
the job. 

Mr. Reinsch. For this function, we have requested and could use 
actually sooner than next year an additional $3 'A million, which is 
peanuts compared to the whole thing. 

Senator Hollings. I worry about it, because you three have got 
a grasp on exactly what my concern is, that the Government gets 
in here and gets on top of infrastructure security that these func- 
tions are properly funded and properly coordinated. From your 
presentations here this morning, the coordination seems to be 
there, but it is a mammoth task. If industry could do it, they would 
have already done it and sold it, you know what I mean? 

Thank you very much, Mr. Chairman. 

Mr. Reinsch. There are areas, Mr. Chairman, if I could com- 
ment, where we think industry is not going to do it, frankly, be- 
cause there is not any money in it. 

Senator Hollings. Thank you. We have had a hearing. 

[Laughter.] 
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Mr. Reinsch. That is the genesis in part of the NIST request for 
its institute. 

Senator Hollings. 

Senator Burns. Is the hearing over? 

[Laughter.] 

Senator Hollings. No. We finally got what we wanted. 

Senator Burns. Senator Wyden. 

STATEMENT OF HON. RON WYDEN, 

U.S. SENATOR FROM OREGON 

Senator Wyden. Thank you, Mr. Chairman. A couple of questions 
for you if I could, Mr. Holder. My judgment is that the challenge 
here is more one of enforcement of existing law, rather than trying 
to develop a whole lot of new laws to deal with that threat. Would 
you agree with that? 

Mr. Holder. I think there are some changes we might want to 
consider with regard to existing law. There are problems, for in- 
stance, with the current jurisdictional limit, where Federal jurisdic- 
tion, criminal jurisdiction begins there is a $5,000 limit we have to 
meet. We think that is an artificially high limit. 

The question of how we are able to use our technology to detect 
who is actually perpetrating these crimes, we have to, for instance, 
go from court to court to court as we are trying to trace back who 
engages in these kinds of attacks, and every time we go to a dif- 
ferent State or a different jurisdiction we have to come up with a 
new court order, and the thought about maybe having a national 
court order that would allow us to get access to that information, 
I mean, there are a number of things that we are thinking about. 

In terms of legislation we might propose, any legislation we pro- 
pose would have to be balanced between the investigative needs 
that we have and the privacy interests that are really paramount 
in this area. 

Senator Wyden. I can tell you, I think the American people are 
going to be real concerned about the discussion about national 
court orders, legislation in that area. As you know, there is enor- 
mous concern right now about privacy, and it has now emerged as 
one of the two or three most important concerns to people. 

And the reason I asked you the question about whether you 
think this is more of an enforcement issue rather than a question 
of needing new laws is that the whole history of these kinds of de- 
bates is that we have these threats, and particularly now, where 
we are clearly dealing with people who are not technologically sim- 
pletons — these are very, very sophisticated people — is that we have 
these attacks, and the call goes out for a variety of new laws, and 
very often I think there is the potential to have the cure worse 
than the ailment. 

I guess I would ask next, what would you say to those who are 
troubled by the prospects that there could be further encroach- 
ments on privacy as a result of some of these ideas that you are 
advancing, and I was not familiar in detail with this national court 
order, and I follow this area pretty closely. What would you say to 
those who are concerned about the prospect that this could further 
erode privacy rights, and what assurance would you want to pro- 
vide to them this morning? 



38 


Mr. Holder. Well, I would say first off the requests that we are 
considering are really ones that are, I think, very modest in scope. 
The notion, for instance, about the court order that would have Na- 
tion-wide effect, as we try to track these things down — somebody 
in New Jersey does something that attacks a network, a computer 
Web site in Oregon and runs it through Wisconsin and Texas. 

As we go to try to trace this thing back, and time is important 
in trying to find out who is the perpetrator of this, we get to Wis- 
consin, we get to Texas, and each time we want to go back we have 
to get yet another court order. 

Our proposal, one we are thinking about, is that we would have 
the ability to go to a judge and ask for an order that would allow 
us, as we get to these different States, not to have to go to get an- 
other judge to get essentially what the first judge has already given 
us. 

I do not think that really encroaches on privacy, and I think that 
to assure people, I think everyone should understand that the pro- 
posals we are making are, as I said, very modest in scope, and are 
made by people who are very sensitive to the concerns that people 
have raised about privacy. The reality is, the Internet really can 
only be successful if those privacy interests are considered and, in 
fact, if they are protected. 

Senator Wyden. But understand as well that you are asking for 
powers that the Federal Government would have that largely ex- 
pand the privacy threats to people already who are concerned 
about it in the private sector. Now, your obligation is obviously dif- 
ferent than the obligations in the private sector, and I recognize 
that, but at the same time I think you are going to have to be very 
vigilant in terms of addressing these privacy issues. 

And let me suggest a model that I talked about when we had the 
encryption debate, and one of the things that concerns me is that 
I do not want to see this discussion go the same route as that de- 
bate, where essentially we were gridlocked for years in terms of 
how to address both national security and the desire for companies 
to be able to export these products. 

If the focus is primarily on enforcement, rather than the passage 
of new laws, I think having ongoing discussion with people in the 
private sector so that they can try to tell you how to get out in 
front of the innovation curve, so to speak, where the criminals are 
always more inventive and always more innovative, is the best way 
to deal with this, rather than to go out and try to advance new 
laws, which any way I look at it seem to give the Federal Govern- 
ment more power in areas that will raise privacy questions. 

Mr. Holder. Well, I agree with you, we have to have that inter- 
action with private industry and, as I have indicated, I think in 
terms of protecting the Internet, at least with regard to the initial 
parts of it, I think the responsibility should lie with private indus- 
try, but in terms of legislation, we have also thought about the pro- 
posal that what we would like to do is have electronic communica- 
tions subject to the same consideration, the same kinds of privacy 
safeguards as oral and wire communications, so we would actually 
enhance the privacy considerations. 

Senator Wyden. I think those kinds of things will be well-re- 
ceived. Senator Burns and I have a privacy bill, and if that is the 
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kind of thing you are interested in, I think we would be very open 
to looking at something like that. 

Even in the context of the privacy discussion it may not be solely 
within the province of our committee, but we are very hopeful. We 
have spent well over a year trying to develop a bipartisan privacy 
bill. We are very hopeful that we are going to be able to see 
progress on this and get it out on the floor of the Senate, given the 
public concern, and that is the kind of idea that I think makes a 
lot of sense, because in effect you do advance privacy rights. 

You are addressing what is a concern of law enforcement, but I 
can tell you that if you stand up at a town hall meeting in my 
home State and start talking about national court orders and some 
of the other things that I have seen discussed, I think we may well 
end up with the same sort of gridlock we had on the encryption 
issue, and I do not want to see us go that route. There is too much 
goodwill, I think, in both the law enforcement community and in 
the private sector for us to just go back to that sort of encryption 
model, where everybody is gridlocked for years and years. 

I felt for a long time that we were pursuing in the encryption 
area an approach that instead of a win-win was a lose-lose. It was 
not getting you what you needed in terms of law enforcement, and 
we were losing out in terms of international markets because we 
had this outdated standard in terms of the bit measure and the 
like for exports. 

So let’s pursue a different model. You give us ideas about the 
oral and written communication that make it easier for you to do 
your job and for us to be able to say in Montana and Oregon we 
are advancing people’s privacy, and I think we are on our way to 
a winner, but some of these other suggestions I would urge you to 
be pretty cautious about. 

Mr. Holder. I really think there is an ability, if we really talk 
with one another — there are I think sometimes instinctive reac- 
tions, negative reactions to the notion that we want to have addi- 
tional legislation, and yet when we have interacted with industry 
and specifically told them these are the kinds of things we are 
thinking about, the reaction we have had has actually been pretty 
favorable, and people seem somewhat surprised when we say we 
also want to do things on the privacy side and have requirements 
that apply to wire and oral communications also apply to electronic 
communications. 

I think that shows the necessary sensitivity that I think we have 
in the Government as we formulate these proposals. 

Senator Wyden. Clearly, a prospect that we can start bringing 
to the online world some of these approaches that we have used off- 
line is a very, very promising orientation, and I like that. 

What I think is going to raise the decibel level and generate 
much more controversy are some of these issues relating to court 
orders, the evidentiary standards that have been talked about 
concering how to gather some of this information, and the tech- 
niques for gathering it. 

That is what I want us to be cautious about, because in that area 
I think we might harm privacy rights and, set back the legitimate 
businesses that you are understandably concerned about, as I am. 
The unintended consequences prospect is very much alive when 
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you talk about things involving evidence, techniques for gathering 
information, the court orders and the like. I appreciate your sensi- 
tivity and look forward to talking with you. 

Thank you, Mr. Chairman. 

Senator Burns. Thank you. 

You know, going along this same line, this may be the wrong 
question to the wrong panel, but instead of asking for new laws 
and new ways of pursuit of people who would hack, I go back to — 
we were raised — I bet every one of us sitting in here today, we 
were raised in a culture that even though we had open mail boxes 
out on the farm, you just did not touch another man’s mail box be- 
cause there was a Government warning there that you are vio- 
lating the mails. 

Do we have any way of posting warnings — FBI warnings on dub- 
bing old VCR’s, you know. Do we have any way of putting up there, 
it is a violation, a Federal violation to wander even into cyberspace 
in areas where you are unauthorized? I do not know, I am just 
thinking about it as he was talking about it. You know, the direc- 
tion we are going, how do we know these people think that they 
are in violation of doing something and there are severe penalties 
for doing so? 

Mr. Holder. I suppose there are technical ways to do that. I 
would really defer to industry as to how effective they think those 
kinds of things might be and whether, frankly, there might be 
some chilling effect in having those kinds of warnings, but again, 
it is not something I have really thought about. 

Mr. Vatis. We do have banners on Federal computers that warn 
people who are coming into a system that if they are intruding 
without authorization, that constitutes a Federal crime, and that 
their activities that are subject to being monitored and inves- 
tigated. 

There are not, as far as I know, similar banners on all private 
sector systems, but it would certainly be technically feasible and 
fully legal for someone to put such a banner on a private sector sys- 
tem and say, “If you intrude into my system I will report the inci- 
dent to law enforcement and I will seek to have you prosecuted if 
you violate Federal law.” 

Senator Burns. Well, I am just saying, you know, even though 
we walked by our neighbor’s mail boxes every day, you just did not 
fiddle around with another man’s mail, and there was a post — 
every mail box we ever bought there was a Government message 
there, even though it was never locked or anything like that, and 
we were raised in that culture. You were taught that when you 
were a little child in your neighborhoods. 

Mr. Holder. I think that is an important point, and a very good 
one, in that we need to do something with our young people in par- 
ticular, but I think people more generally — people tend not to take 
the kinds of lessons that we learn with other things and apply 
them to the Internet. 

There are privacy concerns that people have. There are certain 
things that you would not do in the material, the real world that 
people seem to do when it gets to the cyber world, or to the Inter- 
net, and we need to train people to make them more sensitive, 
make them aware that the kinds of don’ts, things you would not 
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do in the real world you should also not do when it conies to the 
cyber world, so it is a question, I think, of educating people and 
training them. 

Senator Burns. I was just thinking, in the conversation, the cul- 
ture you were raised in, and that if you did monkey with somebody 
else’s mailbox, they would usually beat you home and they called 
your mom and dad up and you got quite a beating when you got 
home. 

But I just wonder if there is some way, even when signing on, 
if the operating bed or the operating system that you have got, 
there is not a warning that you have a certain responsibility, you 
are licensed to use this, but you have a certain responsibility that 
goes along with it. And I am wondering if something like that can 
be done and would scare off maybe some of the folks who would 
tend to wander into areas where they are not supposed to be. 

We want to thank you for your testimony this morning. The in- 
dustry comes up next. I want to beg of you to let us know, Mem- 
bers of Congress. It does not hurt, even in the security area, where 
we cannot discuss things maybe in an open forum, but we can in 
a private forum, either in your office or, it does not make any dif- 
ference. But keep us abreast, if you would, of what is going on out 
here. 

I am going to ask a question. How serious is this business? Ex- 
tortion is a terrible, terrible thing that happens in any society. Is 
it a big problem in the Internet world? 

Mr. Vatis. There have been numerous instances of extortion 
plots carried out via e-mail, and threats delivered by e-mail. There 
have also been specifically computer-related extortion efforts, 
where criminals have said, “Unless you pay me a certain amount 
of money, I am going to shut down your system or I am going to 
do something else to harm you.” 

Before these denial of service attacks took place, the last highly 
publicized example of a cybercrime was exactly that sort of extor- 
tion attempt, where somebody broke into a company called CD Uni- 
verse (which sells CD’s online), stole numerous credit card numbers 
from that company, and then threatened the company by saying 
that, unless CD Universe paid a certain amount of money, the 
hacker would post those credit card numbers on a Web site — which 
he subsequently did. That is another case that we have under in- 
vestigation, but it is only one example of a rising trend in that sort 
of extortion scheme. 

Senator Burns. Well, that does not scare me much, because my 
wife keeps our credit cards right up to the limit, so they are not 
going to be OKed anyway. [Laughter.] 

No, not really. She is coming back to town. We have got to clear 
that from the record. [Laughter.] 

But I just wondered how bad that situation was, because I know 
that is a terrible, terrible, terrible crime. And thank you again this 
morning for your time and your testimony. We appreciate that very 
much. And if other Senators do have questions, I will direct them 
to you. And if you could respond to them and the committee, it 
would certainly help. And your full statements will be made part 
of the record. And we thank you for coming this morning. 
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We move now to the second panel, made up of Mr. Michael 
Fuhrman, who is Manager, Security Consulting, Cisco Systems, out 
of San Jose, California; Paul Misener, who is Vice President of 
Amazon, out of Seattle; and Raj Reddy, from Herbert A. Simon Pro- 
fessor of Computer Science and Robotics, Carnegie Mellon Univer- 
sity, out of Pittsburgh, Pennsylvania. 

Gentlemen, we appreciate you coming this morning and sharing 
your information with us. Again, you can summarize your state- 
ments, and rest assured that your full statements will be made a 
part of the record. Again, I thank you for coming this morning. 

Mr. Misener, we will start off with you this morning. 

STATEMENT OF PAUL MISENER, VICE PRESIDENT, 
GLOBAL PUBLIC POLICY, AMAZON.COM 

Mr. Misener. Good morning, Chairman Burns. It is very good to 
see you again, in particular. I thank you very much for inviting me. 

My name is Paul Misener, and I am Amazon. corn’s Vice Presi- 
dent for Global Public Policy. Amazon.com opened its virtual doors 
in July 1995, with a mission to use the Internet to transform book 
buying into the fastest, easiest, and most enjoyable shopping expe- 
rience possible. Today, Amazon.com also offers consumer elec- 
tronics, toys, CD’s, videos, DVD’s, home improvement tools, and 
much more. Seventeen million people in more than 160 countries 
have made us the leading online shopping site. And we also have 
a thriving auctionsite, Mr. Chairman. 

Amazon.com greatly appreciates the opportunity to testify before 
your Subcommittee. 

Senator Burns. You are starving us old auctioneers to death. 

[Laughter.] 

Mr. Misener. Please join us there. 

Amazon.com greatly appreciates this opportunity to testify before 
your Subcommittee on the recent distributed denial of service at- 
tacks. We look forward to working with Congress to address these 
incidents and other important Internet policy issues. 

Because the Internet and electronic commerce is the driving fac- 
tor in the current booming economy, our Nation’s economic well- 
being depends in part on stopping illegal activity that impedes e- 
commerce. We particularly support the Federal Government’s in- 
volvement in fighting criminal behavior on the Internet. And we 
recognize and appreciate, however, your Subcommittee’s important 
role in overseeing communications commerce. 

Mr. Chairman, although the distributed denial of service inci- 
dents that occurred last month have been described many times in 
the press and elsewhere, a short description of what specifically 
happened to Amazon.com bears repeating. In essence, for about an 
hour on February 8, 2000, a large amount of so-called junk traffic 
was directed to our Internet site. This junk traffic degraded the 
technical quality of service at the site. To be clear, this was not a 
break-in at our online premises, but rather a deliberate and illegit- 
imate crowding of virtual driveways and sidewalks around our on- 
line store. This crowding somewhat hinders our customers’ ability 
to visit and shop. 

At all times during this crowding, however, our customers’ infor- 
mation was safe and secure, and many customers were able to 
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enter our store and shop. Nonetheless, for about an hour, our cus- 
tomers experienced congestion-related delays when visiting the 
site. For Amazon.com customers’, who have come to expect the 
world’s best online shopping experience, even such a relatively 
minor inconvenience was frustrating. 

This is a key point for these hearings, Mr. Chairman. Consumers 
are the ones inconvenienced by distributed denial of service at- 
tacks. Indeed, millions of consumers have come to rely on the Inter- 
net to communicate, shop, invest, obtain news, and learn online. 
The denial of service attacks last month interrupted these impor- 
tant consumer activities and, thus, it is on behalf of consumers that 
all of us must work to prevent these attacks in the future. 

So what can the Federal Government do about denial of service 
attacks? Amazon.com believes the Government’s key role should be 
to prosecute the perpetrators of these and other online criminal ac- 
tivities. Currently laws have been used successfully in recent cases. 
In addition, some have suggested extending existing laws or enact- 
ing new laws, and others have suggested establishing stiffer pen- 
alties under existing statutes. 

On behalf of our current and future customers, Amazon.com 
would be happy to work with Congress on any new legislation to 
address Internet crime issues. 

Successful prosecutions, of course, also rely on adequate re- 
sources with which to conduct investigations. Amazon.com believes 
that additional resources should be applied in at least four areas: 
law enforcement training, personnel retention, public education, 
and agency coordination. 

Let me say a few things about each area. First, continuous train- 
ing of law enforcement personnel in the latest digital forensic tech- 
niques, as well as current Internet technologies, should be at the 
top of any list for additional funding. In particular, additional 
training in electronic evidence handling is necessary, for preserva- 
tion of digital evidence is as important for cybercrime prosecutions 
as preservation of fingerprints is for physical crimes. 

Second, given the strong demand for information technology ex- 
perts, both within and outside of Government, law enforcement 
agencies need additional resources to retain senior IT professionals 
and attract new ones. 

Third, Federal law enforcement agencies should have sufficient 
resources to help educate private industry and consumers on pre- 
venting Internet-related crime. 

Finally, better coordination and communication among Federal, 
State, local, and international law enforcement agencies is needed. 
The recent incidents were not geographically localized, and there is 
no reason to expect future Internet crime to be. 

In all of these areas, increased Government interaction with pri- 
vate industry would help. Amazon.com already is engaged in this 
sort of informal partnership. In addition to existing ongoing inves- 
tigations, our technologists are working with various law enforce- 
ment personnel on the latest developments in Internet technology 
and techniques. We believe it would be premature, however, to for- 
malize this partnership. 

Absent from our suggested Federal response is a role for the Fed- 
eral Communications Commission. The reason is straightforward: 
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The distributed denial of service attacks involved coordinated and 
criminal transmission of content over the Internet. It is hard to see 
how the FCC has statutory authority over such matters. And even 
if it had or were given such authority, the agency currently lacks 
the resources and expertise to do what is necessary at this point; 
namely, to fight the criminal activity. 

Simply put, useful FCC involvement would require statutory 
changes, additional resources and additional expertise to succeed. 
This is work better left to law enforcement agencies. 

In conclusion, Mr. Chairman, we applaud your effort to address 
these denial of service attacks and to formulate an appropriate 
Federal response. As indicated, we believe the situation currently 
is best handled using law enforcement mechanisms. But we would 
appreciate your Subcommittee’s continued interest in the matter. 

On behalf of our current and future customers, Amazon.com 
stands ready to help. Thank you very much for the opportunity to 
testify before your Subcommittee. I would be pleased to answer 
your questions and I look forward to working with you. 

[The prepared statement of Mr. Misener follows:] 

Prepared Statement of Paul Misener, Vice President, 

Global Public Policy, Amazon.com 

My name is Paul Misener, and I am Amazon.com’s Vice President for Global Pub- 
lic Policy. Amazon.com opened its virtual doors in July 1995 with a mission to use 
the Internet to transform book buying into the fastest, easiest, and most enjoyable 
shopping experience possible. Today, Amazon.com also offers consumer electronics, 
toys, CDs, videos, DVDs, home improvement tools, and much more. Seventeen mil- 
lion people in more than 160 countries have made us the leading online shopping 
site. 

Amazon.com greatly appreciates the opportunity to testify before your Sub- 
committee on the recent distributed denial of service attacks. We look forward to 
working with Congress to address these incidents and other important Internet pol- 
icy issues. Because electronic commerce is the driving factor in the current booming 
economy, our nation’s economic well-being depends in part on stopping illegal activ- 
ity that impedes e-commerce. 

We particularly support the Federal Government’s involvement in fighting crimi- 
nal behavior on the Internet. We recognize and appreciate, however, your Sub- 
committee’s important role in overseeing communications commerce. 

Mr. Chairman, although the distributed denial of service incidents that occurred 
last month have been described many times in the press and elsewhere, a short de- 
scription of what specifically happened to Amazon.com bears repeating. 

In essence, for about an hour on February 8, 2000, a large amount of so-called 
“junk traffic” was directed to our Internet site. This junk traffic degraded the tech- 
nical quality of service at the site. 

To be clear: this was not a break-in at our online premises but, rather, a delib- 
erate and illegitimate crowding of the virtual “driveways and sidewalks” around our 
online store. This crowding somewhat hindered our customers’ ability to visit and 
shop. 

At all times during this crowding, however, our customers’ information was safe 
and secure, and many customers were able to enter and shop at our store. Nonethe- 
less, for about an hour, our customers experienced congestion-related delays when 
visiting the site. For Amazon.com’s customers, who have come to expect the world’s 
best online shopping experience, even such a relatively minor inconvenience was 
frustrating. 

This is a key point for these hearings: consumers are the ones inconvenienced by 
distributed denial of service attacks. Indeed, millions of consumers have come to 
rely on the Internet to communicate, shop, invest, obtain news, and learn online. 
The denial of service attacks last month interrupted these important consumer ac- 
tivities and, thus, it is on behalf of consumers that all of us must work to prevent 
these attacks in the future. 

So what can the Federal Government do about denial of service attacks? Ama- 
zon.com believes the Government’s key role should be to prosecute the perpetrators 
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of these and other online criminal activities. Current laws have been used success- 
fully in recent cases. In addition, some have suggested extending existing law or en- 
acting new laws, and others have suggested establishing stiffer penalties under ex- 
isting statutes. 

On behalf of our current and future customers, Amazon.com would be happy to 
work with Congress on any new legislation to address Internet crime issues. 

Successful prosecutions, of course, also rely on adequate resources with which to 
conduct investigations. Amazon.com believes that additional resources should be ap- 
plied in at least four areas: law enforcement training, personnel retention, public 
education, and agency coordination. Let me say a few things about each area. 

First, continuous training of law enforcement personnel in the latest digital foren- 
sic techniques, as well as current Internet technologies, should be at the top of any 
list for additional funding. In particular, additional training in electronic evidence 
handling is necessary, for preservation of digital evidence is as important for 
cybercrime prosecutions as preservation of fingerprints is for physical crimes. 

Second, given the strong demand for information technology experts, both within 
and outside of Government, law enforcement agencies need additional resources to 
retain senior IT professionals and attract new ones. 

Third, Federal law enforcement agencies should have sufficient resources to help 
educate private industry and consumers on preventing Internet-related crime. 

Finally, better coordination and communication among Federal, state, local, and 
international law enforcement agencies is needed. The recent incidents were not 
geographically localized, and there is no reason to expect future Internet crime to 
be. 

In all of these areas, increased Government interaction with private industry 
would help. Amazon.com already is engaged in this sort of informal partnership: in 
addition to assisting the ongoing investigations, our technologists are working with 
various law enforcement personnel on the latest developments in Internet tech- 
nology and techniques. We believe it would be premature, however, to formalize this 
partnership. 

Absent from our suggested Federal response is a role for the Federal Communica- 
tions Commission. The reason is straightforward: the distributed denials of service 
attacks involve coordinated and criminal transmission of content over the Internet. 
It is hard to see how the FCC has statutory authority over such matters. Yet even 
if it had, or were given, such authority, the agency currently lacks the resources and 
expertise to do what is necessary at this point, namely, to fight the criminal activity. 
Simply put, useful FCC involvement would require statutory changes, additional re- 
sources, and additional expertise to succeed. This is work better left to law enforce- 
ment agencies. 

In conclusion, Mr. Chairman, we applaud your effort to address these denials of 
service attacks and to formulate an appropriate Federal response. As indicated, we 
believe the situation currently is best handled using law enforcement mechanisms, 
but we would appreciate your Subcommittee’s continued interest in the matter. On 
behalf of our current and future customers, Amazon.com stands ready to help. 

Thank you very much for the opportunity to testify before your Subcommittees. 
I would be pleased to answer your questions and I look forward to working with 
you. 

Senator Burns. Thank you very much, Mr. Misener. 

Now we have Michael Fuhrman, who is Manager, Security Con- 
sulting, Cisco Systems. Welcome before the Subcommittee. We look 
forward to your testimony. 

STATEMENT OF MICHAEL FUHRMAN, MANAGER, 
SECURITY CONSULTING, CISCO SYSTEMS 

Mr. Fuhrman. Thank you, Chairman Burns. 

I am Michael Fuhrman of Cisco Systems. As you know, Chair- 
man, we are the largest manufacturer of equipment that connects 
people and businesses to the Internet. We are based in San Jose, 
California, and we have large operations in Massachusetts, North 
Carolina and Texas. 

Senator Burns. Did you ever consider Montana? 

[Laughter.] 

Mr. Fuhrman. We do have sales offices in Montana, yes. 
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In particular, I manage our company’s Security Consulting Serv- 
ices Group, which helps to ensure the security of some of the best 
known sites on the Internet. My team of engineers and specialists 
evaluate the protective measures being employed by our customers. 
We help them respond to anyone or anything that threatens the in- 
tegrity of their systems. And as last month’s hacker attacks on 
some of the world’s busiest Web sites graphically demonstrated, 
this is a task that requires constant vigilance. 

Cisco security specialists were among those who responded to the 
denial of service attacks that temporarily blocked access to several 
sites, beginning on February 7th. I am happy to tell you that we 
were able to help some of our customers quickly identify the tech- 
nology being used in the attacks, employ effective countermeasures, 
and beat back repeat efforts by hackers to obstruct access. 

Now, in a nutshell, the hackers initially were able to briefly shut 
customers out of some targeted Web sites, as Mr. Misener said, by 
bombarding these sites with more information than they could 
process at the time. In a way, we liken it to the Internet equivalent 
of trying to go shopping the day after Thanksgiving. The crowds 
are overwhelming and the parking lots are full. The difference in 
this case is, however, that people were not prepared for this activ- 
ity. 

Now, after these assaults, there was some heated speculation 
about whether the public can depend on the Internet as a reliable 
means of doing business and sharing information. Now, the lesson 
to be learned from the attacks is not that the hackers have some 
sort of technological edge. On the contrary, the technology that is 
employed in these attacks is well-known to those of us in the sys- 
tems security field. Proper defenses for a majority of these, the 
technology does exist. 

The lesson is that events like this can be anticipated and man- 
aged with the proper diligence and planning. The technology com- 
munity showed that it can respond swiftly and effectively, taking 
steps to quickly mitigate the attacks and to make it harder for fu- 
ture attacks in the future. 

Now, it is important to note, in all of these assaults, targeted 
Web sites were interrupted only for relatively brief periods. It is 
also important to note, again, as Mr. Misener stated, these attacks 
blocked access to some systems, but did not penetrate into the in- 
ternal systems of these companies. 

The technology community has already joined with the Federal 
Government to respond more effectively should attacks like these 
be repeated in the future. The community and the Government are 
forming an organization that will disseminate critical information 
quickly and widely if the Internet is threatened. 

We at Cisco keenly understand the importance of this task. We 
will conduct $12 billion of business over our Web site this year. 
Our employees perform 95 percent of their tasks on our Web site. 
My consulting group in particular recently conducted a 6-month 
survey of 33 businesses connected to the Internet, where we meas- 
ured their state of security. We found that, on average, one out of 
every three of the companies’ devices connected to the Internet 
were vulnerable to some form of attack or another. 
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We also found, however, that 90 percent of the vulnerabilities 
could be solved with technology that was readily available today, 
if the technology is properly employed and consistently updated. 
Now, this, of course, is easy to say and extraordinarily difficult to 
do. 

We have to remember that a decade ago the Internet was little 
more than a clunky mechanism that a few educational research in- 
stitutions used to trade messages we now all know as E-mail. The 
blazing speed at which the Internet has developed and the equally 
rapid pace at which threats to the Internet’s security have evolved 
make it hard even for those who build and maintain Web sites to 
keep pace. 

But businesses and others who operate Web sites are learning 
that security must become an ever more important concern. The 
number of companies who come to Cisco, for instance, in assistance 
in securing their networks has grown by over 50 percent over the 
last 12 months alone — a very encouraging statistic. And we have 
all learned that one thing the technology can do collectively is to 
increase the sharing of information about up-to-the-minute devel- 
opments in security. 

We believe that this public/private partnership is the most effec- 
tive response to the recent attacks. In the private sector, incentives 
must be put into place to encourage all Web sites to deploy security 
technologies, to protect themselves and their customers from hack- 
er attacks. In the public sector, we are grateful that the Federal 
Bureau of Investigation has devoted significant resources to inves- 
tigating these attacks. And we hope that the perpetrators will be 
prosecuted to the fullest extent of the law. 

We encourage the Federal Government to serve as a role model 
for private industry, by equipping its own computer systems with 
the best security measures possible. This, too, of course, will not be 
easy. Both the Government and private enterprise are having dif- 
ficulty attracting and retaining enough skilled professionals in the 
field of systems security. I am happy to tell you that the private 
sector has joined with the Office of Personnel Management to help 
the Government in the area by developing training and mentoring 
programs. Again, we regard this as an excellent example of public/ 
private partnership. 

At this time, however, we do not ask Congress for new laws in 
the area of Internet security. Cooperation, not regulation, not legis- 
lation, will ensure that the Internet remains secure and, at the 
same time, open to the broadest public access. The Internet is and 
always should remain an open medium. No one can insulate the 
Internet and everything connected to it from all threats, or guar- 
antee that no attack on any particular Internet site will succeed. 

Even our oldest, most established public infrastructures pause on 
occasion. Power and telephone lines come down, water mains 
break, highways become clogged. And like them, the Internet will 
occasionally have localized difficulties. These are but potholes on 
the information superhighway, which we will fill in as fast as they 
appear, learning how to prevent similar potholes in the future. 

The recent attacks actually demonstrated that the technology 
community can quickly identify threats to the Internet, quickly act 
to eliminate them, and quickly take measures that will reduce the 
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impact of similar threats in the future. This spirit of innovation 
and rapid development propels the Internet’s exponential growth 
and ensures that the Internet will remain secure as it continues to 
grow. 

Thank you. I look forward to your questions. 

[The prepared statement of Mr. Fuhrman follows:] 

Prepared Statement of Michael Fuhrman, Manager, 

Security Consulting, Cisco Systems 

Chairman Burns and distinguished senators, I am Mike Fuhrman of Cisco Sys- 
tems. As you may know, Cisco is the world’s largest manufacturer of equipment that 
connects people and businesses to the Internet. We are based in San Jose, California 
and have substantial operations in Massachusetts, North Carolina and Texas. 

I manage our company’s Secure Consulting Services Group, which helps ensure 
the security of some of the best-known sites on the Internet. My team of engineers 
and specialists evaluates the protective measures being employed by our customers 
and helps them respond to anyone or anything that threatens the integrity of their 
systems. As last month’s hacker attacks on some of the world’s busiest web sites 
graphically demonstrated, this is a task that requires constant vigilance. 

Cisco’s security specialists were among those who responded to the so-called “de- 
nial of service attacks” that temporarily blocked access to several web sites begin- 
ning Feb. 7. I’m happy to tell you that we were able to help some of our customers 
quickly identify the technology being used in these attacks, employ effective counter- 
measures and beat back repeat efforts by hackers to obstruct access. 

In a nutshell, hackers initially were able to briefly shut customers out of some 
targeted web sites by bombarding those sites with more information, some of it more 
false or misleading, than they were able to process. In a way, it was the Internet 
equivalent of trying to shop on the day after Thanksgiving, when the crowds are 
overwhelming. But in this case, the problem was nobody knew the rush was coming 
and therefore we weren’t quite prepared to handle it. 

After these assaults, there was some overheated speculation about whether the 
public can depend on the Internet as a reliable means of doing business and sharing 
information. The lesson to be learned from these attacks is not that hackers have 
some kind of technological edge that enabled them to do what they did. On the con- 
trary, the technology employed in these attacks is well known to those of us in the 
systems security field and proper defenses against that technology are widely avail- 
able. 

The lesson is that events like these can be anticipated and managed with dili- 
gence and proper planning. The technology community showed that it can respond 
swiftly and effectively, taking steps to quickly mitigate the attacks and to make it 
harder for similar assaults to succeed in the future. 

It’s important to note that, in all of these assaults, service to targeted web sites 
was interrupted only for relatively brief periods. It’s also important to note that 
while these attacks blocked access to some targeted computer systems, they do not 
appear to have penetrated the outer defenses of these systems. We know of no case 
in which hackers obtained access to confidential customer information, such as cred- 
it card numbers, or did lasting damage to any of the targeted sites. 

And it’s important to note that the technology community has already joined with 
the Federal Government to respond more effectively should attacks like these be re- 
peated in the future. The community and the Government are forming an organiza- 
tion that will disseminate critical information quickly and widely if the Internet is 
threatened. 

We at Cisco Systems keenly understand the importance of this task. We will con- 
duct $12 billion worth of business over our own web site this year, and our employ- 
ees are able to perform about 95 percent of their work on the site. 

Cisco Secure Consulting Services recently conducted a six-month survey of 33 
businesses connected to the Internet and measured their “state of security.” We 
found that, on average, one out of every three devices connected to the Internet was 
vulnerable to some form of attack. But we also found that over 90 percent of the 
vulnerabilities could be solved with technology that is readily available, if the tech- 
nology is properly employed and constantly updated. 

This is easy to say and extraordinarily difficult to do. A decade ago, the Internet 
was little more than a clunky mechanism that a few educational and research insti- 
tutions used to trade messages we now know as email. The blazing speed at which 
the Internet has developed — and the equally rapid pace at which threats to Internet 
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security have evolved — make it hard even for those who build and operate web sites 
to keep pace. 

But businesses and others who operate web sites are learning that security must 
become an ever-more-important concern. The number of companies who have come 
to Cisco for assistance in securing their networks has grown by over 50 percent dur- 
ing the last 12 months alone — a very encouraging statistic. And we have all learned 
that one thing the technology community can do collectively to increase is to share 
information about up-to-the-minute developments in systems security. 

The community has joined with the Federal Government to do just this. Even be- 
fore last month’s attacks, industry leaders had joined to form the Partnership for 
Critical Infrastructure Security. The PCIS is a voluntary organization that is work- 
ing to share information about threats to the Internet and other crucial networks, 
and determine how best to respond to those threats. About 120 companies are co- 
operating in this effort. 

And last month at the White House information technology summit, Cisco was 
one of about 40 Internet companies that agreed to develop a structured mechanism 
to react to events like the recent hacker attacks. As with the PCIS, industry is co- 
ordinating its activities with the Federal Government. 

We believe that this public-private partnership is the most effective response to 
these recent attacks. In the private sector, incentives must be put into place to en- 
courage all web sites to deploy security technologies to protect themselves and their 
customers from hacker attacks. 

In the public sector, we are grateful that the Federal Bureau of Investigation has 
devoted significant resources to investigating these attacks and we hope the per- 
petrators will be prosecuted to the fullest extent of the law. We encourage the Fed- 
eral Government to serve as a model for private industry by equipping its own com- 
puter systems with the best security measures possible. 

This, too, will not be easy. Both the Government and private enterprise are hav- 
ing difficulty attracting and retaining enough skilled professionals in the field of 
systems security. I’m happy to tell you that the private sector has joined with the 
Office of Personnel Management to help the Government in this area by developing 
training and mentoring programs. Again, we regard this as an excellent example of 
public-private partnership. 

At this time, however, we do not ask Congress for new laws in the area of Inter- 
net security. Cooperation, not regulation or legislation, will insure that the Internet 
remains secure and at the same time open to the broadest possible public access. 

The Internet is, and should always remain, an open medium. No one can insulate 
the Internet and everything connected to it from all threats or guarantees that no 
attack on any particular Internet site will succeed. Even our oldest, most estab- 
lished public infrastructures pause on occasion — power and telephone lines come 
down, water mains break, highways become clogged — and, like them, the Internet 
will occasionally have localized difficulties. These are but potholes on the informa- 
tion superhighway, which we will fill in as fast as they appear — learning how to pre- 
vent similar potholes in the future. 

These recent attacks actually demonstrated that the technology community can 
quickly identify threats to the Internet, quickly act to eliminate them and quickly 
take measures that will reduce the impact of similar threats in the future. This spir- 
it of innovation and rapid development propels the Internet’s exponential growth 
and ensures that the Internet will remain secure as it continues to grow. 

Thank you. I look forward to your questions. 

Senator Burns. Thank you, Mr. Fuhrman. 

Dr. Reddy, welcome to our Subcommittee. 

And can I get your statement right after this? 

Senator Abraham. Why do we not let him go. 

Senator Burns. I think that is wise. Thank you. 

Dr. Reddy, thank you very much for coming this morning. We 
look forward to your testimony. 

STATEMENT OF RAJ REDDY, PH.D., HERBERT A. SIMON 
PROFESSOR OF COMPUTER SCIENCE AND ROBOTICS, 
CARNEGIE MELLON UNIVERSITY 

Dr. Reddy. Thank you, Mr. Chairman. This is a great oppor- 
tunity for us to testify before the Subcommittee. 
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My name is Raj Reddy. I am the Herbert A. Simon Professor of 
Computer Science and Robotics at Carnegie Mellon University. I 
also serve as the Co-Chair of the President’s Information and Tech- 
nology Advisory Committee, commonly known as PITAC. 

In the PITAC February 1999 report to the President, labeled “In- 
formation Technology: Investing in our Future,” we highlighted the 
need for increased investments in national security — about 15 
months ago — as well as a number of other research areas. 

Today, on behalf of PITAC, I will provide you with insights into 
the state of the Internet security in our country and outline some 
of the PITAC recommendations that will help our Nation to build 
and support a more reliable, available, secure, and scalable Inter- 
net. I will also provide some personal observations on, besides legal 
and administrative remedies, what research and technology rem- 
edies might exist to solve this problem of denial of service. 

While advances in information technology have created unprece- 
dented economic growth and transformed our lives in thousands of 
positive ways, weaknesses still remain that enable malicious hack- 
ers to disrupt Internet service and overload popular Web sites. An 
analysis of these highly visible disruptions to the Internet reveals 
a wide range of causes, including denial of service from hackers. 

The PITAC shares Congress’ concern about these recent hacker 
attacks. In our February 1999 report, we observed that the Inter- 
net has grown well beyond the intent of its original designers 25 
years ago, and that our ability to extend its use has created enor- 
mous challenges. In our report, we recommended a research agen- 
da to help ensure the survivability of our information infrastruc- 
ture in the face of malicious attacks, equipment and software fail- 
ures, and legal overload, where a large number of people call in a 
Schwab account site on a busy stock market day. 

We concluded that the support for critical, long-term funda- 
mental research in IT is diminishing, and that the current research 
is too focused on near-term problems related to agency missions. To 
help maintain the U.S. leadership in IT, information technology, 
and restore a commitment to high-risk, high-return research, we 
recommended that the Federal Government create a strategic ini- 
tiative in long-term R&D funding, and increase the funding for 
R&D over the next 5 years by $1.4 billion. 

Our report recommended a balanced research agenda in soft- 
ware, scalable information infrastructure, high-end computing, and 
work force implications. Specifically, we recommended research to 
support scalable information infrastructure, authentication and se- 
curity mechanisms, mechanisms for detecting system intrusion, 
mechanisms for detecting mitigating and responding and recov- 
ering from human error in the creation and the use of the infra- 
structure, mechanisms for assuring information quality, and a 
number of others. 

PITAC is encouraged by the strong bipartisan support for the in- 
formation technology research and development and by the $235 
million increased appropriation this year for the Federal IT R&D 
programs. Based largely on our recommendations, the administra- 
tion proposal for the fiscal year 2001 budget includes a $600 mil- 
lion increase in investments for a balanced information technology 
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R&D program, which includes funding for networking and software 
research to enable more secure, reliable, dependable networks. 

We applaud the Senate’s past leadership in supporting this infor- 
mation technology R&D, and we hope you will support the full set 
of research priorities we recommended in our report. 

Now I would like to make some personal observations on the spe- 
cific problem of Internet security. Remedies to the problems of de- 
nial of service attacks and security loopholes and insider risks, 
there are a number of different ways of skinning this cat. One is 
legal; the other is administrative; and, finally, there is also an op- 
portunity to use research and technology to stop many of these 
problems. And I would like to share with you some ideas on that 
topic. 

I propose that we establish a national network test bed that can 
be used to develop and demonstrate what I will refer to as an 
ultra-dependable, self-healing Internet. The purpose of this test bed 
is to try out new approaches without disrupting the crucial produc- 
tion infrastructure. It is an R&D vehicle. The proposed test bed 
will be similar to the ultra high-speed network test bed, NGI, Next 
Generation Internet, that has been funded in the last few years. 

It will include attributes such as reliability, availability, 
scalability, in addition to security. The operative issue is not secu- 
rity alone, as interpreted narrowly, but how to create a dependable 
Internet that we can all trust, like we trust the telephone system 
today. The ultra-dependable Internet would be used to develop 
technologies to enable self-healing networks. 

A self-healing network would work similar to the human immune 
system. It would continuously monitor the system — in this case, the 
network — analyze what is happening in the system, what packets 
are going through, and it would detect abnormal patterns auto- 
matically and immediately begin actions to remedy this problem. It 
would use software agents, capable of self-monitoring, self-diag- 
nosing, and self-repair, much as the human immune system uses 
distributed antibodies to disable antigens and restore balance in 
the human body. 

Just as in the human system, where a few people may occasion- 
ally get sick but the society as a whole continues to function, we 
may accept an occasional denial of Internet service in a particular 
location, as long as most of the users are able to access most of the 
Web sites most of the time without any degradation of service. The 
proposed self-healing network will increase the packet handling 
overhead and perhaps make the system slower. We believe, with 
the exponential growth in technology, this will not be a serious 
problem in the future. 

In addition to the research needed to develop the faster net- 
works, we will also need research in data warehousing of meta- 
data contained in the packet headers, data mining of the statistical 
parameters that would classify normal and abnormal traffic, and 
repair strategies for generating signals that would make abnormal 
requests detectable. 

In conclusion, I believe the creation of a dependable Internet in- 
frastructure, as dependable as the telephone service, is essential to 
the future of the economic growth and security of this Nation. To 
accomplish this, we need bold new research initiatives and uniform 
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application of ideas across the international Internet infrastruc- 
ture. Support for the increased Federal investments in IT R&D is 
a positive first step. But continued dialog among Federal research- 
ers, industry and academia is essential to create bold new ideas 
like a self-healing, dependable information infrastructure. 

In summary, Mr. Chairman, it is estimated that the market cap- 
italization of the Internet-based industries created since 1990 ex- 
ceeds $1 trillion, resulting in capital gains taxed paid to the Nation 
of over $200 billion. Investing a small fraction of this national in- 
come in research toward creating an ultra-dependable, self-healing 
Internet will help ensure the continuation of this engine of growth. 

Thank you. 

[The prepared statement of Dr. Reddy follows:] 

Prepared Statement of Raj Reddy, Ph.D., Herbert A. Simon Professor of 
Computer Science and Robotics, Carnegie Mellon University 

Introduction 

Mr. Chairman and Members of the Subcommittee, thank you for this opportunity 
to testify about important research and development efforts aimed at increasing 
Internet security and protecting our Nation’s Information Infrastructure. 

My name is Raj Reddy, and I am the Herbert A. Simon University Professor of 
Computer Science and Robotics at Carnegie Mellon University. I also serve as Co- 
Chair of the President’s Information Technology Advisory Committee, commonly 
known as PITAC. In the PITAC’s February 1999 report to the President, “Informa- 
tion Technology Research: Investing in Our Future,” we highlighted the need for in- 
creased investment in network security, as well as other important research areas. 
Today, on behalf of PITAC, I will provide you with insight into the state of Internet 
security in our country and outline some of the PITAC recommendations that will 
help our Nation build and support a more reliable, available, secure, and scalable 
Internet. I will also present my personal views on an R&D strategy for developing 
and demonstrating highly dependable networks. 

Background 

While advances in information technology have created unprecedented economic 
growth and transformed our lives in thousands of positive ways, weaknesses still 
exist that enable malicious hackers to disrupt Internet service and overload popular 
Web sites. An analysis of the highly visible disruptions to Internet access reveals 
a wide range of causes, including denial of service attacks from malicious hackers 
using insecure hosts infected with “zombie” diseases (Yahoo!), software bugs 
(Ameritrade), insecure configurations (Schwab), change management (E-trade), and 
security loopholes (Hotmail, Melissa). 

PITAC shares Congress’ concern about these recent hacker attacks. In our report 
to the President, we observed that “the Internet is growing well beyond the intent 
of its original designers and our ability to extend its use has created enormous chal- 
lenges. As the size, capability, and complexity of the Internet grows, it is imperative 
that we do the necessary research to learn how to build and use large, complex, 
highly-reliable, and secure systems ... It is therefore important that the Federal 
Government undertake research on topics ranging from network reliability and 
bandwidth, to robust, reliable, secure ways to deliver and to protect critical informa- 
tion.” In our report, we recommended a research agenda to help ensure the surviv- 
ability of our information infrastructure in the face of malicious attacks or viruses, 
equipment or software failures, and overload. Before I discuss the specifics of the 
R&D agenda for Internet security, I would first like to briefly summarize the find- 
ings and recommendations of our report. 

The PITAC Report Findings and Recommendations 

The PITAC was established pursuant to the High Performance Computing Act of 
1991 and was tasked to look at a number of issues in high performance computing 
and communications. After a detailed review of the Federal IT R&D programs, we 
concluded that U.S. leadership in IT provides an essential foundation for promoting 
economic growth, education and research, environmental stewardship, public health, 
and national security. We also concluded that there has been an erosion of support 
for long-term fundamental research in IT and that current research is too focused 
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on near-term problems linked to agency missions. Our Committee recommended 
that the Federal Government create a strategic initiative for long-term R&D and in- 
crease funding for IT R&D by $1.4 billion by fiscal year 2004 over the fiscal year 
1999 base programs funding level. Our report recommended a balanced research 
agenda, with priority for the following areas: 

• Software: Methods for efficiently creating and maintaining high-quality soft- 
ware of all kinds and for ensuring the reliability of the complex software sys- 
tems that now provide the infrastructure for much of our Government and our 
economy. 

• Scalable Information Infrastructure: Techniques for ensuring that the Na- 
tional Information Infrastructure consisting of communications systems, the 
Internet, large data repositories, and other emerging systems is reliable and se- 
cure, and can grow gracefully to accommodate the massive numbers of new 
users (perhaps billions) and applications expected over the coming two decades. 

• High End Computing : Continued invention and innovation in the develop- 
ment of fast, powerful computing systems and the accompanying communication 
systems are needed to implement critical science, engineering, and business ap- 
plications ranging from aircraft design to weather and climate modeling. 

• Social, Economic, and Workforce Implications of IT: Research directed to- 
wards better understanding the sociological and economic impacts of innova- 
tions in information technology and toward growing the workforce to meet the 
national need for information technology professionals. 

Our recommendation for research to support a scalable information infrastructure 
included topics to enable the survivability of our networks and information. Surviv- 
ability means that services will be available when needed and information will be 
delivered in a timely fashion. The recommended research agenda includes: 

• Authentication and security mechanisms for a large, heterogeneous, and 
evolving infrastructure 

• Mechanisms for detecting system intrusion and information software corrup- 
tion 

• Mechanisms for detecting, mitigating, responding to, and recovering from, or 
for preventing, human error in the creation and use of the infrastructure 

• Mechanisms for assuring information quality 

• Scalable information and service replication strategies 

• Mechanisms for monitoring services to ensure correct operation within given 
quality-of-service bounds 

• Repositories for guaranteed long-term preservation of information 

Our report recommendations have received strong bi-partisan support and we 
were encouraged by the $235 million increase for IT R&D appropriated in this 
year’s budget. The President’s fiscal year 2001 budget proposes an increase of nearly 
$600 million in IT R&D in a balanced research program that addresses the rec- 
ommendations in the PITAC report. Proposed funding includes networking and soft- 
ware research directed towards technologies to enable more secure, reliable, and de- 
pendable networks. The PITAC applauds the Senate’s past support and leadership 
for IT R&D and hopes the Senate will support the full set of research priority areas 
recommended in our report. 

The PITAC report provides broad concepts for a balanced IT R&D program. While 
we recognized the importance of network security, reliability, and dependability, we 
did not develop a detailed R&D agenda for Internet security. Our recommendations 
cover a range of important topics to be addressed, rather than proposals for specific 
research projects. 

The Impact of Internet Downtime on Businesses and Society 

Denial of service happens when the network fabric is overloaded through inten- 
tional and unintentional (“legal”) overloading of the system with too many requests. 
This is analogous to a large number of people calling California in the event of an 
earthquake report, or a computer calling a phone continuously thereby blocking any- 
one else getting through in case of an emergency. The cost of denial of service and 
overloading can be substantial. The Yankee Group estimates that the online indus- 
try may have lost $1.2 billion in revenue from the Web site attacks earlier this 
month. (WSJ, Feb 24, 2000). A Gartner Group study showed that the average cost 
of downtime in brokerage operations is about $6.5 million per hour! According to 
the Boston-based market research firm, $29 million in refunds were paid out by 
MCI to customers affected by the 10 day outage of its frame relay network in Au- 
gust 1999. Three thousand companies were affected. (Online News, 10/28/99). eBay 
paid $3.9 million in credits to its customers for the service outage that halted bid- 
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ding completely at its popular service for an unprecedented 22 hours in June 1999. 
Distributed network sites can lose $20,000 to $80,000 per hour. ( Computer Reseller 
News, 1998). At a cost of $80,000 per hour, the average company will lose $7.1 mil- 
lion per year in centralized network downtime. 

These costs are expected to increase as companies incur indirect costs in the form 
of lawsuits, regulatory scrutiny, impact on brand name and public image, loss of 
customer base, lower employee morale and productivity, and higher employee stress. 

The impact on businesses of system outage can be even more devastating. In an 
April 1999 survey of consumers, research firm Jupiter Communications found that 
46 percent leave a preferred site if they experience technical or performance prob- 
lems. Statistics from McGladrey and Pullen show that for every five organizations 
affected by a disaster, two will be unable to maintain their critical business func- 
tions and make a recovery. Of the remaining three, one will not survive the next 
two years. In fact, a company that experiences a computer outage lasting more than 
10 days will never fully recover financially (“Disaster Recovery Planning: Managing 
Risk and Catastrophe in Information Systems” by Jon Toigo). 

According to Cahners in-stat group, Internet downtime hits businesses financially, 
(http://www.instat.com/abstracts/ia/1999/is9906sp — abs.htm), affecting direct rev- 
enue/customer base, compensatory payments, inventory cost, and depreciation of 
capital. It also affects business in ways not seen on the balance sheet, such as mar- 
ket capitalization loss, employee downtime, and delays to market items that may 
prove more financially damaging than the explicit losses associated with an outage. 
The report “Data Failure: The Financial Impact on Internet Business” quantifies the 
real-cost damages for site outages based on SEC filings and publicly released infor- 
mation. The report compares two e-commerce business models and illustrates how 
much is at stake in the event of data failure. 

Steps Towards a Secure and Dependable Internet 

Many of the problems of Internet access can be avoided by taking some simple 
common sense precautions. For example: 

Online businesses can: 

• Educate users on cyber hygiene, security tools, and procedures such as use 
of the firewalls, intrusion detection systems, anti-virus software, automatic 
daily disinfecting tools, etc. 

• Discourage masquerading and spoofing attacks by ensuring that network 
traffic exiting from the local area network of an organization carries the address 
consistent with the valid set of addresses for that organization. 

• Protect against inside hacker risk by providing backup and retrieval from an 
off-site storage service provider. Disaster tolerance backup facilities are offered 
by many suppliers. Such services guarantee constant availability of data in the 
face of technical or natural catastrophe, including surge capabilities for un- 
planned swells in site traffic. 

• Provide 24 hour-per-day, 7 day-a-week physical security to central facilities 
and server farms. Alternatively, use the backup and retrieval from an off-site 
storage service as described in the previous bullet. 

Industry can: 

• Release hardware and software that prevents insecure configurations, and 
provide tools for intrusion detection. 

• Re-engineer operating systems and applications to make them immune to 
the effects of viruses and other forms of malicious code. 

• Identify and close the security loopholes and backdoors by working with 
major vendors to provide access to the source code and encourage open source 
movement. 

• Develop and deploy a secure communications infrastructure that can be used 
by network operators and Internet service providers to enable real-time collabo- 
ration when dealing with attacks. 

Many of the common sense measures listed above depend on the voluntary compli- 
ance of more than a 100 million Internet users and organizations that provide Inter- 
net service. However, history has shown us that compliance failures will occur, ei- 
ther unintentionally or maliciously. Rather than leaving the Internet vulnerable be- 
cause a few persons or organizations are careless or reckless, we should develop an 
information infrastructure that is not dependent on voluntary compliance of security 
practices and policies. 
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Personal Views on a Strategy for a National Self Healing Network Testbed 

I would now like to make some personal observations and make a specific rec- 
ommendation for creating a national self healing network testbed. The PITAC rec- 
ommended an aggressive new program in networking research, including network 
security. We also recommended expanded research to explore ways that laws pro- 
tecting privacy, intellectual property, and other rights are extended effectively into 
this new media. We continue to support increased funding in these critical areas. 

The PITAC is currently reviewing Federal research plans and will be issuing new 
recommendations later this year. Since these new recommendations are not avail- 
able, I would like to present my personal views on logical next steps. 

By now we understand the sources of highly publicized Internet crashes: mali- 
cious hacker attacks and “legal” users overloading popular web sites. Many of the 
remedies require straightforward implementation of known solutions, either admin- 
istrative or legal. However, herein lies the problem — we simply cannot depend on 
every system to be properly administered or every person to behave as desired. In- 
stead, we should strive to develop an Internet infrastructure in which it does not 
matter if someone is careless or reckless. In my view, one of the key goals of net- 
working research over the next few years should be development of a “self healing” 
network. A self healing network would work similar to the human immune system. 
It would constantly monitor the system (in this case, the network), analyze what 
is in the system, and if it finds something wrong within the system, immediately 
begin actions to remedy the problem. A self healing network would be capable of 
self-monitoring, self-diagnosing and self-repairing. To accomplish this, we should es- 
tablish a national network testbed that can be used to develop and demonstrate 
what I will refer to as an “ultra-dependable Internet.” This is similar to an ultra- 
high speed network, but with the focus on dependability rather than speed. 

I will use the phrase “dependable Internet” to specifically include attributes such 
as reliability, availability, and scalability in addition to security. The operative issue 
is not “security” as interpreted narrowly in the research circles but rather “how to 
create a dependable Internet Infrastructure” that is as reliable as the current tele- 
phone system. By dependable, I mean a system (“as if my life depended on it”) that 
is: 

• reliable, i.e., always up, accessible, accurate, and consistent, 

• available, i.e., a system with no world-wide-wait and a response time of 
under 200 milliseconds most of the time, 

• scalable, i.e. an infrastructure capable of scaling to a billion simultaneous 
users and a trillion inter-connected devices, and 

• secure, i.e. no fear of loss of privacy and immunity to sniffing and spoofing. 

The goal of a self healing network is to provide mechanisms for detecting unau- 
thorized use of networking equipment, tracking inappropriate uses, and identifying 
the individuals using networks for malicious intent, without compromising indi- 
vidual rights to privacy and security on the network. Over the years we have found 
ways to balance privacy and security in traditional commerce. Applying these prece- 
dents to the new networked world will require combining the skills of technologists 
and people knowledgeable of the legal, economic, and social issues. Clearly this is 
an enormous challenge, but I believe it is a critical national research challenge and 
deserves an appropriate response. 

A Self Healing Network 

A self healing network is one which continuously monitors all the traffic within 
the system (every packet entering the system is validated before it can proceed) 
with a view to detect and disable abnormal traffic patterns. It is predicated on using 
“software agents” capable of self-monitoring, self-diagnosis, and self-repair much as 
the human immune system uses (distributed) anti-bodies to disable antigens and re- 
store balance in the human body. Just as in human systems where a few people 
may get sick some of the time, but society as a whole continues to function, we may 
accept an occasional denial of service as long as most users are able to access most 
of the web sites without any degradation of service. 

Self monitoring within the Internet core fabric requires agents capable of contin- 
uous and autonomous monitoring of “packet” traffic using “software sensors.” “Self 
repair agents” undertake a set of autonomous corrective actions against the offend- 
ing source that is generating the unusual traffic by dropping the packets or limiting 
it to a “fair share” the number of packets entering the fabric. The work of these 
agents and the humans tracking network security could be helped if the new gen- 
eration of routers add information packets that make it easier to detect malicious 
patterns of use and to track the attacks to their source. 
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The proposed self healing network will add to the packet handling overhead at 
each router in the fabric and has the potential to make the system slower, waste 
bandwidth, and compromise privacy. At first blush, this requirement appears to be 
impractical, as the Internet is expected to handle trillions of packets every day and 
would require expensive retrofitting of the existing commercial Internet Service Pro- 
viders (ISPs). However, such a transition is not only essential to the future economic 
growth and security of the nation, but also practical given the expected exponential 
advances in processor, memory, and optical networking technologies. The expected 
additional overhead in packet handling will be ameliorated by better algorithms, ex- 
ponential improvements in processor (predicted by Moore’s law), memory, and band- 
width technologies and increasing locality of Internet traffic patterns (“Internet is 
global and the traffic is local”). 

In addition to the research needed to develop terabit networks, faster routers, effi- 
cient algorithms, and distributed computation techniques, research will also be 
needed for data warehousing of meta-data contained in packet headers, data mining 
of this data to establish statistical parameters that can be used to classify normal 
and abnormal traffic requests, and repair strategies for generating a signal (analo- 
gous to the busy signal used in voice telephony) to sites making abnormal requests 
without prior arrangement for surge capacity. 

Conclusion 

In conclusion, creating a dependable Internet infrastructure that is as dependable 
as telephone service is essential to the future economic growth and security of the 
nation. It is possible to create a system capable of achieving these goals while ensur- 
ing absolute protection of personal privacy and without major reductions in net- 
working speed. Indeed, rapid advances in computing power and networking speed 
should make the new security systems nearly invisible to users. The main challenge 
is to find the right balance between having a dependable Internet infrastructure 
without compromising the ease of use by non-experts and protecting the privacy of 
the individuals connected to the infrastructure. To accomplish this will require both 
new research ideas and the uniform application of known and new ideas across the 
Internet infrastructure. It makes sense to apply the creative energies of academe 
to these social problems. 

Development of networks capable of meeting our goals for security and privacy 
will only happen with a concerted research investment supported by both Govern- 
ment and industry. One strategy would be to support a network testbed designed 
with the specific goal of evaluating innovative strategies for network protection — 
including commercial concepts. Such a testbed would provide useful networking 
services and at the same time let commercial operators and Government research 
organizations evaluate advanced networking security concepts. 

It is estimated that market capitalization of Internet based industries created 
since 1990 is more than a trillion dollars resulting in capital gains taxes of more 
than $200 billion to the nation. Investing a small fraction of this national income 
in research towards creating a self healing Internet will ensure the continuation of 
this engine of growth! 
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Senator Burns. Thank you, Doctor. Those are interesting com- 
ments. 

I am going to move to Senator Abraham, who has joined us now. 
If you would like to either make your statement or summarize or 
present it for the record, and if you have questions for this panel, 
we would entertain those at this time. And then I will followup. 

STATEMENT OF HON. SPENCER ABRAHAM, 

U.S. SENATOR FROM MICHIGAN 

Senator Abraham. Thank you very much, Senator Burns. And 
thank you for your leadership on the Subcommittee level and on 
the full committee level on these issues. We appreciate what you 
do on a variety of these key topics. 
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I just will make a brief statement. I have got two or three con- 
flicting hearings this morning and other events, but I wanted to 
come by because I think this is a really important topic for us to 
focus on. 

I drew from this panel conclusions similar to ones I reached 
based on some meetings I had immediately in the wake of the re- 
cent spate of hacker activity. I was out in the Bay Area, Silicon 
Valley, and met with representatives from about 20 companies at 
that time, which was just in the week afterward, and with a group 
of businesses in my own State. Although Michigan is not as well- 
known as a high-tech center perhaps as other parts of the country, 
we actually do have a real growing industry there. And I came 
away with conclusions very similar to the ones expressed by the 
panelists. 

I do not think there is any question that we need to proceed in 
a careful way here. We have to recognize the extent to which Gov- 
ernment regulations are going to be effective are limited. I do think 
that we need to continue to focus on some of the things we can do 
with respect to penalties that can be invoked against people who 
commit computer-related crimes. I am not sure the current penalty 
structure really is adequate based on what I studied. 

I think the panels at the current time are kind of low. I think 
we need to establish Federal and civil criminal penalties against 
electronic identify theft, attacking one of the tools which is often 
used by cyber-terrorists and techno-thieves. I think we also need to 
examine Federal, civil and criminal penalties with respect to unau- 
thorized access to information systems. I think these are areas 
where we can do some things that do not put such impediments in 
place that we constrict the development of the Internet and the de- 
velopment of e-commerce activities that are going to be going on. 

I also think that we need to encourage Governmentwide policies 
to improve the security of Federal information systems. That is not 
so much under our domain in this particular committee, but I 
think it is an area that we need to, based on these recent develop- 
ments, that we need to perhaps as a Congress focus more attention 
on. And I know that Senator Thompson, in his committee, has fo- 
cused on this and begun to introduce legislation along that line. 

And then I also serve on the Judiciary Committee, and we have 
looked at ways that we could create Federal grant programs to as- 
sist State and local law enforcement agencies in deterring, inves- 
tigating and prosecuting computer crimes. Because obviously some 
of the resources available at the local level tend to maybe not be 
adequate to meet some of the challenges that the high-tech crimi- 
nals pose. And I think that that is a reasonable area for us to both 
be part of and to look into. 

So these are some of the things I am going to be working on. But 
I think we also have to appreciate that there is sort of, obviously, 
a need to recognize the proprietary nature of information that is 
accumulated by industries, of technologies that are developed. And 
this is where I think some of the comments made in your earlier 
statements are particularly relevant. We have to appreciate that 
and understand that we can always come up with, I think, anti- 
crime legislation that can potentially be effective, but sometimes it 
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is so effective that it completely inhibits normal human discourse 
and activity. 

I was saying in my meetings in Michigan, we could presumably 
stop most, if not all, bank robberies if we strip searched everybody 
who went into a bank. But that probably would mean that very few 
people went into banks. Similarly, we can probably come up with 
a variety of processes that would minimize the potential for Inter- 
net crime or cyber-terrorism, but at such a level that there would 
be no more activity of an e-commerce nature or anything else. 

We can always overreach. I think we have to be very careful not 
to. And so I appreciate what you are trying to accomplish today. 
I look forward to working with you. And I thank the panel. I appre- 
ciate very much their participation. 

Senator Burns. Thank you, Senator. 

I have just a couple of questions, and then we will just start the 
dialog. I am concerned. I think Senator Hollings kind of hit on it 
a while ago, and even the panel on law enforcement or those people 
who are in charge of monitoring these kind of activities. While I re- 
alize that you have got to watch the bottom line — I mean, we are 
all in business, we have to make a living and we have an obligation 
to our board of directors and our obligations to our own industry — 
and given the competitiveness of this industry so far, and we have 
tried to maintain this to be very open, very competitive, let 
entrepreneurialship and imagination and ingenuity flow, it seems 
like we have not really given an extra measure to security until we 
had this incident happened with this information. 

Business and security should be complementary, not mutually 
exclusive. And I am wondering if you could comment on this. They 
say you have run out of interest after a while in discussions about 
security. How can we increase this dialog? And how can we height- 
en the interest in security and the working between Government 
and law enforcement? 

I want you all to take a shot at this. So, Mr. Misener, if you want 
to lead it off. 

Mr. Misener. Certainly, Mr. Chairman. There is a need for both 
locks and police. We spent a lot of time talking about the police 
today and a little bit recently on the lock side. We at Amazon.com 
take security very seriously, and it is very important to us as a 
business and to our customers. As indicated before, we did not ex- 
perience a break-in at our premises. Rather, it was this sur- 
rounding of the premises by this junk traffic that was directed to- 
ward our site. 

And so, to that extent, to the extent that there was this criminal 
behavior, we do believe that in addition to the locks that we put 
on our house, that we also need the police to help enforce against 
the criminal activity or prosecute the perpetrators of that criminal 
activity around the outside of the house. 

Senator Burns. Dr. Reddy. 

Dr. Reddy. Mr. Chairman, besides the locks and the police, there 
is a third option. Normally, when we build any infrastructure, 
whether it is the interstate highway system or anything else, the 
Government takes responsibility at certain levels. Unfortunately, 
the Internet fabric, everybody has their own sites and they can se- 
cure those, but no one person is responsible for the Internet fabric. 
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And that is by design. That is the way it was designed in 1969, be- 
cause we wanted it to be scalable. 

However, that particular design has run its course. I think we 
need new research and new test beds to demonstrate an ultra-de- 
pendable network which has all the same features, and it can be 
shown and it can be used and demonstrated. And that is the re- 
sponsibility of the Government, in the sense of what Senator Hol- 
lings was talking about and what you are also saying. It is not a 
question of increasing police, or it is not a question of telling pri- 
vate industry to put on more locks. There is another piece in be- 
tween, the Internet fabric, that no person is responsible for. And 
therefore, the Government has to take responsibility for it. 

Senator Burns. Mr. Fuhrman. 

Mr. Fuhrman. Thank you, Chairman. If I could add, if we step 
back a second, everybody looks through their glasses on life and 
their perspectives are built upon their experiences that they have 
gone through or others that they have observed. And so I think an 
unfortunate step that we have taken here at this point is that we 
have had to wait, in essence, for some of these attacks to occur for 
folks to wake up and go through the experience and realize that 
this is now something that they before had either discounted or 
just had not gotten to yet that is now something to be added up 
to my priority list. 

And I think, as we continue to step closer and we make great 
progress as we go forward, we are going to see businesses and cus- 
tomers start taking security even more seriously than they have in 
the past. 

Senator BURNS. It is very interesting, the field called biometrics, 
where users verify their identity through a pad that scans either 
fingerprints or a monitor that scans retinas, among other devices. 
Does biometrics have a role to play in increasing security on the 
Internet in coming years? What is the potential? Anybody can take 
a shot at that. 

Dr. Reddy. Mr. Chairman, biometrics has the same privacy prob- 
lems. There is even a simpler solution than biometrics. Intel has 
designed into every chip an I.D. So when a packet is transmitted 
from a computer, you can add that I.D. But there was a big hue 
and cry about the privacy issues, and the whole thing stopped 
dead. Anybody that tries to put biometrics or anything else which 
involves identification of the individual, as opposed to just the ma- 
chine that perpetrated the thing, will probably cause the same 
kinds of issues. So I do not know what the right answer is. 

Senator Burns. Mr. Misener. 

Mr. Misener. Mr. Chairman, I share the assessment that this 
would cause perhaps a hue and cry if discussed as a viable option, 
although I would recognize that biometrics and other forms of per- 
sonal identification are important to protecting actual true security 
issues as opposed to sort of online e-commerce issues. 

Senator Burns. Mr. Fuhrman, you can comment on this. But I 
was struck by the fact of what you said a while ago. I really had 
not thought of it in the context that they did not actually get into 
your shop, but they surrounded your shop, and prevented anybody 
else from your normal daily activities. And therein lies the prob- 
lem, more than the security of gaining entry into your shop. 
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Is that a correct assessment? 

Mr. Misener. That is correct. But recognize also, sir, that there 
were security breaches at other sites that allowed the hack attacks 
to occur. For example, at some universities there were security 
breaches, true intrusions of their systems, that allowed these dis- 
tributed denial of service attacks to take place against other sys- 
tems. And those systems were less well protected than others on 
the in terms of. 

Senator BURNS. It was my understanding that it took several 
computers to do all this. And if this person that perpetrated this 
thing, if he had to buy all the computers, he probably would not 
do it. But he could enter other computers and tell them what to 
do. 

Dr. Reddy. Mr. Chairman, there is a problem here. There is also 
legal traffic that can demonstrate the same properties as a hacker 
attack. For example, when Victoria’s Secret announced that they 
were going to have a Web site where they were showing their new 
fashions, everybody and his brother wanted to see it. And the same 
denial of service happened there. There is nothing illegal there. It 
just happened. 

It is like what happens when there is an earthquake in Cali- 
fornia: everybody calls in to make sure that their loved ones are 
safe. You cannot get through. So it is not just illegal, malicious at- 
tacks. Legal things can also cause this problem. That is why you 
need a self-monitoring, self-healing network, which says, sorry, 
there is a lot of traffic going, you cannot use it. There is a busy 
signal. 

So some people at least get through, as much as the traffic would 
permit, at Amazon.com. The rest of the people are not able to get 
through. Rather than everybody being stopped. 

Senator BURNS. The other day I visited a facility that monitors 
telephone traffic. It tells them where they have a problem, they 
have a line outage. And it tells them that they are rerouting. And 
also during particular times of day their traffic is such that there 
is a potential that they have to add another line or to reroute the 
traffic or then protect what 911 does and all of this. Are we saying 
that? 

Dr. Reddy. The same thing. 

Senator Burns. The same thing. We are going down the same 
line. 

Dr. Reddy. It is what is called a network management system. 
We need an Internet network management system. And what hap- 
pens now is, as we heard from the previous panel, the Government 
is somehow going to protect each of their sites. But I can still dis- 
able people from getting through to your site. And what we need 
is to stop it at the source, not at the destination. And that requires 
a complete concept of knowing exactly the overall well-being of the 
entire network all the time. That is the kind of thing you saw in 
the telephone systems. We do not have that. 

Senator BURNS. Do you envision an automatic thermostat, so to 
speak? 

Dr. Reddy. Yes, that is exactly it. The whole idea is to build a 
dependable network in which there is a continuous monitoring of 
the entire traffic from everybody, and knowing where the abnormal 
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behavior is happening, and then shut them down at the source 
rather than letting them come all the way to the Government site 
and there trying to block them from getting in. 

Senator Burns. It offers interesting challenges. It really does. 
Any closing statements by any of you? 

[No response.] 

Senator Burns [continuing]. None at all. Well, we appreciate 
your coming here today and sharing this information. We will prob- 
ably investigate this further. 

Dr. Reddy, I am very interested in what your testimony is here 
today, and I would hope that the rest of the Senators on this Com- 
mittee read it. And I think that they will, because you offer several 
suggestions in there that I think we should take note of. And all 
of you who have offered suggestions, I appreciate that. 

Again, industry, the teamwork thing has to happen. Because I 
am not convinced right now that there has to be new laws or any- 
thing like that. I am saying that we as an industry have to come 
together. And it is like I said a while ago, in security, we were all 
raised that you do not fool around with somebody else’s mailbox, 
but I do not see any warning out there like I saw on a mailbox or 
our folks got on us about that. I know those things have to be 
taken into account. 

Thank you very much. These hearings are closed. 

[Whereupon, at 11:20 a.m., the hearing was adjourned.] 
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Prepared Statement of Max Cleland, U.S. Senator from Georgia 

Good morning Mr. Chairman and distinguished guests. The tremendous advances 
being made in the computer and telecommunications industries are forever chang- 
ing the way we do business in this country and abroad. This new digital age in 
which we are living has ushered in the ability to trade stock, shop for a car, buy 
air line tickets and to buy, sell and trade just about anything else using the Inter- 
net. Many of the firms that are engaging in this new way of doing business didn’t 
exist a few years or even months ago. The growth of e-commerce has been so rapid 
that projections made about how much business will be conducted over the Internet 
were often outdated as soon as they are published. On March second of this year 
the Commerce Department released the first ever estimate of retail e-commerce 
sales or e-tail sales. Reported e-tail sales over the Internet and other electronic net- 
works have reached a historic $5.3 billion in the fourth quarter of 1999. 

While there are now new opportunities for the good people of our nation to gain 
greater productivity and have access to a wider selection of goods and services, there 
is an attendant menace to on-line businesses which threatens to disrupt the way 
commerce is conducted over the Internet. This menace is HACKERs who are seek- 
ing to gain unauthorized access to systems for the purpose of destroying, corrupting, 
stealing or monitoring information vital to the operation of computer systems owned 
by others. 

These hackers have distinguishing screen names, or aliases, and are apparently 
very bright, intelligent people with deviant, malicious minds and a hankering for 
chaos. One suspected hacker is a 17 year-old New England boy who told investiga- 
tors that he has been using computers since he was three and spends 16 hours a 
day on the Internet. 

All businesses must be protected from the hackers, but no where is it more impor- 
tant than the businesses and industries that are vital to the nation’s health, wealth 
and security and make up our nation’s critical infrastructure. These critical infra- 
structure businesses and industries are engaged in information and communica- 
tions, banking and finance, basic utilities, aviation, mass transit, public health serv- 
ices, and oil and gas production and storage. On the Government side, the critical 
infrastructure consists of internal security, Federal law enforcement, foreign intel- 
ligence, foreign affairs and national defense. All of these activities must be protected 
from the destructive, corruptive, stealing or monitoring of information by unauthor- 
ized persons. Anyone attempting to hack into these systems must be stopped be- 
cause their actions threaten our country’s security. 

A GAO report released March second of this year provides commentary on the 
proposed Government Information Security Act and cites some very disturbing facts 
about the state of the Government’s computer security: 

The Environmental Protection Agency has had invasions of its systems that re- 
sulted in damage and disruption to that agency’s operations. 

The Department of Veterans Administration has been cited for weaknesses in 
its computer systems that could compromise sensitive medical and benefit pay- 
ment information of our nation’s veterans. 

A test on the National Aeronautics and Space Administration’s systems reveled 
that their systems could have been penetrated posing serious threats to orbiting 
spacecraft and the scientific data received from these spacecrafts. 

The State Department’s computers are also vulnerable to attack and unauthor- 
ized access by hackers, terrorists or other unauthorized individuals. 

It appears that from this listing that there is a pressing need to improve computer 
security planning and management and to make the cases like these just cited the 
exception, not the rule in the Government’s systems. 

Fear, mistrust and the uncertainties created by hackers can slow the economic 
growth and prosperity that many public and private sector experts envision for the 
Internet. As the Government sets out to continue to protect our nation’s critical in- 
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frastructure from domestic and foreign intruders and e-businesses set out to reduce 
the costs of theft and destruction of data and hardware by hackers, we must ensure 
that people seeking to do business over the Internet are safe from hackers, and that 
sufficient cooperation and coordination between the Government and private indus- 
try is encouraged. Most recently this cooperation resulted in a smooth transition to 
the year 2000. We can and must replicate these results in the area of computer se- 
curity. 

I am very interested in hearing from the panel about your thoughts with regard 
to the scope and magnitude of the hacker problem and what your recommendations 
are for putting hackers out of business. 
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